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FOREWORD 


"This document constitutes Volume 3 of a seven-volume Final 
Report^npr^epared by Teledyne Brown Engineering, Huntsville, Alabama, 
under NASA^'Gontjact No. NASlO-8676, Launch Site Processing of 
Hazardous Payloads. ^This study required a thorough analysis of the 
impact on the launch site and its operations by hazardous Space Shuttle 
payloads. - ^ 

The seven volumes of the Final Report are as follows: 

Volume 1. EXECUTIVE SUMMARY : ' This volume presents a 
concise review of the results of the study tasks and summarizes the 
principal conclusions and recommendations of the study. 

Volume 2. HAZARDOUS PAYLOADS SURVEY AND ANALYSIS: 
This volume presents the results of a survey and analysis of proposed 
Shuttle payloads to identify hazardous'payloads and define the character- 
istics of materials and systems which make them hazardous. This task 
included the development of a hazardous payloads ranking technique 
and recommendations for processing analysis on selected payloads. 

Volume 3. NORMAL PROCESSING ANALYSISY ^-This volume 
presents preliminary normal processing flow plans for three Shuttle 
cargoes selected as a result of the Hazardous Payloads Survey and 
Analysis Task. These three cargoes are:^ 

• ';^Spacelab with Advanced Technology Laboratory j 


Tug, Solar Electric Propulsion Stage, 
Earth Observatory Satellite = 3*^^ 


and Synchronous 


Fluorine Propul 


^ VJ lilt ' 


' The preliminary processing flow plans include identification of 
unique facilities and GSE, processing hazards, and payload safety 
related design criteria. 


Volume 4. CONTINGENCY PROCESSING ANALYSIS, This 
volume presents preliminary alternate processing flow plans for 
contingency situations for the three Shuttle cargoes analyzed in the 
Normal Processing Analysis Task. 
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Volume 5. CURRENT PAYLOADS SURVEY AND ANALYSIS ; 
This volume presents the results of a survey and analysis to determine 
payloads that are currently flying and that may also fly on the Shuttle 
vehicle when it becomes operational. The analysis determines 
hazardous materials/systems for each of these current payloads and 
recommends design and operational safety criteria for each hazardous 
current payload to minimize its impact on the Shuttle Transportation 
System. 

Volume 6. ENVIRONMENTAL IMPACT STATEMENT 
POTENTIAL REQUIREMENTS : This volume presents the results of an 

evaluation of the probable environmental impact of Shuttle payloads 
hazardous materials and includes recommended KSC Environmental 
Impact Statement Potential Requirements. 

Volume 7. ADVANCED TECHNOLOGY REQUIREMENTS: This 
volume presents a list of special problems identified in the study which 
require advanced technology study or technology development. 
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1.0 INTRODUCTION 


Payloads containing hazardous materials associated with space 
vehicle launch operations have been recognized and dealt with on previ- 
ous R&tD space programs. However, when compared to the Shuttle 
Program, these R&D space programs involved relatively few launches 
with considerable time between launches. The Shuttle operational pro- 
gram will have a high launch rate and in many cases individual launches 
will have several independent payloads for accomplishment of separate 
missions. Some of these payloads by intent will be recoverable for pur- 
pose of reuse, and all must be recoverable in the sense that possible 
abort situations prior to deployment have to be recognized. 

Present processing schedules have been derived assuming 
nominal passive payloads and nominal payload flow time, A number of 
specifically safety oriented studies on Shuttle payloads has been per- 
formed in recent years. However, relatively few of these have treated 
ground operations in depth, and the overall impact of Shuttle payload 
hazards on launch and landing site processing and procedures has not 
been documented. In order to fill this gap, this ten month study was 
initiated in July 1974, The overall study objectives were to uncover and 
determine the hazard potential of Shuttle payloads, develop safety 
oriented normal and contingency launch site processing plans for selected 
cargoes that will minimize the impact on cost and schedules, and pro- 
vide for environmental protection, 

1. 1 TASK OBJECTIVES 

The purpose of the normal processing analysis task was to develop 
and analyze normal launch site processing flows for each of the cargoes 
selected as a result of the hazardous payloads survey and analysis task. 
These three cargoes are: 

• Spacelab with Advanced Technology Laboratory (ATL) and 
Integrated Real Time Contamination Monitor (IRTCM). 

• Tug, Solar Electric Propulsion Stage (SEPS),and Synchronous 
Earth Observatory Satellite (SEOS), 

• Interim Upper Stage (lUS) and a Pioneer Jupiter Probe (PJP) 
with a Fluorine Propulsion Unit (F^PU), 

This task included the development of normal processing flow plans 
to a level necessary to identify all processing hazards, time lines, unique 
facilities and Ground Support Equipment (GSE) requirements, safety 
requirements for launch site protection, and payload safety related design 
criteria. 
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U2 SCOPE 

The normal processing analysis task analyzed all processing 
operations relative to receiving, storing, test and checkout, integration 
with the Orbiter and/or upper stage, launch preparations, and landing and 
refurbishment at the launch site for the three cargoes selected as a 
result of the hazardous payloads survey and analysis task. 

1 . 3 TASK APPR OAC H 

Figure 1 illustrates the analysis approach for the normal pro- 
cessing and hazards analysis of the three cargoes selected and approved 
by KSC for analysis in this task. 

The philosophy was to develop a processing plan that was a 
balance between safety considerations and processing constraints. Our 
goal was to minimize on-line processing and at the same time minimize 
personnel exposure to hazards, minimize exposure of payloads to other 
payload hazards, and minimize Orbiter exposure to payload hazards. 

In developing the normal processing flow, the first step was to 
develop a processing scenario for each cargo showing the major pro- 
cessing steps and processing locations. Data from KSC^s Launch Site 
Accommodations Handbook for Shuttle Payloads were used as a basis for 
developing the initial top-level scenarios. KSC Shuttle Operations 
Planning Office's time line allocations along with facilities planning data 
from the Shuttle Projects Office and discussion with KSC personnel were 
used as additional information sources for developing the scenarios. 

A top-level flow was then developed to show individual payload 
operations, cargo operations, launch operations, and post-launch opera- 
tions. This top-level flow is essentially an index of operations at differ- 
ent areas and was expanded into a detailed operational sequence for each 
cargo. This was an iterative process and the normal base line flows 
were revised several times. 

For each individual operation on the normal flows, a functional 
event sheet was prepared to define the operation to a level necessary to 
identify all hazards, estimate operations times, and identify GSE, For 
each hazard identified, a Hazard Mode Effects Analysis (HMEA) was 
performed to determine the potential hazard effect, A support equipment 
listing was prepared for the GSE and facility requirements for processing 
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FIGURE 1. ANALYSIS METHODOLOGY 
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operations that were identified. From this listing, a support equipment 
identification sheet was prepared for the items that were new, peculiar, 
or associated with hazardous operations. 


A waterfall/ time line chart was prepared to show the normal 
processing sequence of operations and the processing time line. The 
time lines noted in this report are not valid in every case because they 
were obtained in the early part of the study and have since changed. 

The time lines, however, have no impact on the intent of the study. 

For the latest valid times to correlate with specific Teledyne Brown 
Engineering (TBE) time lines, see the following documents: 


NAME OF DOCUMENT CONTACT 

KSC Spacelab Operational Turnaround F. Bryan, LO 

Allocation, March 17, 197 5 


Shuttle/ Tug Turnaround Allocation, 
December 16, 1974 


Don E. Phillips, 
SP-OPN 


Level III Shuttle Turnaround Allocation 
Payload Installation at Orbiter Processing 
Facility, April 1, 1975 

Level III Shuttle Turnaround Allocation 
Payload Installation at Launch Pad, 

April 1, 1975 


Don E, Phillips, 
SP-OPN 


Don E. Phillips, 
SP-OPN 


1,4 SUMMARY OF RESULTS 


1.4.1 Cargo Hazards 

The three cargoes normal base line processing flows and 
functional event descriptions resulted in the identification of 28 different 
types of hazards distributed throughout 237 operational events. An 
analysis of each event, of the operations involved, and of the hazardous 
systems was performed to determine the effect of the hazard on per- 
sonnel, facilities, payloads, Orbiter, and the environment. To reduce 
or eliminate the effects of the payload hazards, 87 payload design 
recommendations were made, 125 safety related operational require- 
ments were identified, and 57 items/ requirements for support equip- 
ment were generated. The hazards that were identified for each of the 
three cargoes, the frequency of occurrence, and the final hazard 
categorization are shown in Table I. 
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TABLE I. CARGO HAZARDS SUMMARY 



Freque ncy 

01 Occurrence 

Final H.i/.ird 

Har.ard Types 

Space l.ib 

Tug 

lUS 

Categori Mtion 

High Pressure 

7 

18 

15 

Cataat r opi: :c 

Cryogenic F, Overpre 

s sure 


5 

1 Catastri phic *nd 





4 Critic<il 

Hydrazine Methyl Derivatives 

6 

5 

Critical 

Mercury 


2 


Critica 1 

APS Thruster Firing - 

Toxic Gas 

2 

2 

Critical 

Cryogenic O 2 


3 


Critical 

Cryogenic 


4 


Critical 

CF^ 



1 

Critical 

Cryogenic F^ 



2 

C ritica 1 




2 

1 Critical ind 





1 Controlled 

GN, Purge 

1 

15 

6 

ControUec 

Electrical Power 

6 

26 

13 

Contr ollec 

RF Emissions 


4 

3 

ControUec 

Laser 

2 

1 


ControUec 

High Temperature 


1 

1 

ControUec 

Moving Equipment 


1 


ControUec 

F reon 

3 



ControUec 

Pyrotechnics - Safed 


5 

2 

C ont roUec 

Pyrotechnics - Armed 

2 

2 

1 

ControUec 

Batteries 


4 

1 

ControUec 

Hydraulics 


1 


Control lec 

Purge with Hot GN 2 


1 


ControUec 

Radar 

2 



ControUec 

Steam Generator 

2 



ControUec 

Mic robiolog ical 

3 



ControUec 

Cryogenic 



5 

Controlled 

Radiological 



*» 

ControUec 

Krypton 85 



2 

ControUec 


1.4,2 Interface Hazards 

Those operational events containing more than one hazard and 
those operations where hazards were continued from previous events 
were examined for possible interface hazards. 

In the Spacelab/ATL/IRTCM cargo, two events were found to 
present an interface hazard potential and both of these involved electrical 
power application checks that could lead to the inadvertent activation 
of other hazardous sources such as laser, radar, or steam generator. 

The major interface hazards for the IUS/F 2 F^U/ PJP cargo are 
centered around fluorine and other hypergolic materials such as hydrazine 
and N20^, The potentially catastrophic effect of a water leak from the 
Radioisotope Thermoelectric Generator (RTG) cooling jackets combining 
with a fluorine leak is also an interaction hazard. Fluorine leakages 
could adversely affect critical electronics and control circuits. 

In the Tug/SEPS/SEOS cargo, the 10 events found to present 
an interface hazard potential had as their common causative or accessory 
hazard the application or use of electrical power. Electrical power 
application usually involves checks, tests, and/or verification of various 
communications networks, control systems, and interfaces. The elec- 
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trical power application can lead to the inadvertent activation of other 
hazardous sources, such as RF generating systems, lasers, heaters or 
thruster gimbals. Mercury leakage could also cause electrical shorts, 
arcing, and affect critical circuits. 

In all cargoes, the application of electrical power or mal- 
function in an electrical system could lead to the ignition of spilled or 
leaking fuels. Similarly, inadvertent power application to pyrotechnic 
devices could result in the ignition of other fuel souices. Finally, the 
presence of propellant reactants {LO 2 , LH^, LF^j ^2^4^ 

presents a potentially catastrophic situation if simultaneous leakages 
should occur, 

1.4.3 Time Fine Analysis 

The time line analysis conducted revealed that no Orbiter con- 
straints are imposed. For safety reasons, it was necessary to perform 
off-line loading of fluorine in the F 2 pU, This operation involves passi- 
vation, loading, stabilizing, and monitoring, which is a 31 -hr operation. 
Obviously, without off-line fluorine loading the Orbiter processing would 
have been impacted. 

1.4.4 GSE/Facility Identification for Normal Processing 

Fifty seven items of GSE/facility were identified for the normal 
processing of all three cargoes. The items that may cause a significant 
impact on KSC are as follows: 

• GSE 

-«IUS/F 2 PU Cargo Transporter (FN 2 Dewar and Monitoring 
System) 

--Portable Fluorine Disposal Unit and LN 2 Dewar for use at: 
-Fluorine Loading Facility 
-SAEF #1 
-Launch Pad 

--Personal Life Support Equipment Compatible with Fluorine 
--Fluorine Sensing Systems 
--Mercury Servicing Unit 
--Mercury Sensing Systems 
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• Facilities 

Dedicated Fluorine Facility 

-- Hydrazine APS Dedicated Loading Area in SAEF #1 
Mobile Biological Holding Facility 
-- Laser Test Facility 

1,4.5 Principal Conclusions and Recommendations 

The primary findings, conclusions, and recommendations that 
resulted from this task are as follows: 

• Fluorine 

Because of the hazardous characteristics of fluorine and 
the time required for passivations, loading, and thermal 
stabilization (31 hr ) fluorine loading should be performed 
off line. 

A special fluorine loading facility designed/dedicated 
only to fluorine loading /unloading is required to provide 
personnel and environmental protection during this 
hazardous operation. 

The fluorine loading facility will require almost continual 
maintenance / service between periods of usage to maintain 
the facility in a condition that can safely handle F 2 . This 
is due to the corrosive and reactive nature of fluorine 
that requires that all lines, tanks, valves, etc. , be 
maintained in a dry inert condition, and that aiter each 
use, the system be completely purged to remove F 2 in 
order to prevent severe corrosion. If these are 
relatively long periods between use, it may be necessary 
to disassemble and inspect a large part of the facility 
before use. 

The fluorine propulsion unit oxidizer system should be 
designed to allow in-space pressurization (to operating 
pressure). 

The F 2 PU must be designed such that it can be processed 
as a separate unit from the PJP. 
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Onboard LiN^ cooling system £or F^PU will be required 
to maintain thermal balance and pressure level until the 
unit is in orbit. 

Ground cooling with LN^ is required through the Orbiter 
T -0 umbilical to reduce the required supply of onboard 
supply of LN^ cooling. 

• Mercury 

Mercury propellant should be loaded off-line in an area 
to prevent spills from contaminating the facility, Orbiter, 
other payloads, or the environment. This is primarily 
due to the dispersive nature of mercury and difficulty in 
cleanup. 

Mercury servicing provisions should be provided by a 
portable servicing unit and should include storage tank, 
valves, lines, etc. 

A vacuum system with a filtered exhaust for spill cleanup, 
a vacuum pipette system for picking up small particles, 
splash pans and spill aprons should also be provided for 
mercury servicing. 

• Microbiological Species 

Biological sample containers for transfer and flight must 
be fail safe (double walled, and include biocide to render 
specimens harmless if inside container is damaged). 

A biological facility and mobile biological unit will be 
required for preparation and transporting biological/ 
microorganisms to prevent release of any pathogenic 
hazards. 

Trained and equipped biological survey /decontamination 
teams will be required. 

• Radiological - RTG*s 

Cooling Requirements 

External water cooling system must be provided for 
pad operations (recommend through the Orbiter T -0 
umbilical) . 
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Requires onboard water cooling system. 

Radiation Exposure Hazards 

Special handling equipment, fixtures and facilities 
required to limit radiation exposure of operating 
personnel, 

Unit(s) must be installed in cargo/Orbiter as late 
in processing sequence as possible to limit radiation 
exposure of personnel. 


• General 

Final pressurization of high pressure systems must be 
performed at the pad late in the countdown (before crew 
boards) , 

Final pressurization of hazardous fluid systems should 
be pressurized as late in the mission as possible. Per- 
forming this operation just before deployment into space 
from the Orbiter for APS and after deployment in space 
for MPS. This requires that all hazardous fluid systems 
design have regulated pressurizing systems (no blowdown 
systems). 

All hazardous fluid systems should be pressure and leak 
checked to operating pressure at KSC during ground 
operations before loading. All high pressure systems 
should be pressure and leaic checked at KSC before 
installation in the Orbiter, 

It is recommended that the use of pyrotechnic devices in 
payloads be minimized because many payloads have RF 
generating devices (Radar, Lidar, Antenna’s, etc.). It 
is desirable that access to all payload pyrotechnics 
Class A devices (EED's, etc. ) be provided so that con- 
nection could be performed after installation in the cargo 
bay and disconnection could be performed before removal 
in case of a pad backout. 

Hazardous payloads systems and experiments which gen- 
erate RF, laser beams, heat, or other energy sources 
should have multiple interlocks to prevent inadvertent 
actuation. 
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Special facilities, covers, protection, etc. should be 
provided for energy generating equipment (RF, Laser, 
etc, )--i. e, , laser test facility, antenna covers, RF 
shields, etc. 
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2.0 SPACELAB/ATL CARGO PROCESSING PLAN 

2. 1 CARGO DESCRIPTION 

The cargo consisting of Spacelab, ATL experiments, and the 
IRTCM experiment is the presently scheduled payload for the fifth operational 
flight of the Shuttle flights and is designated Shuttle Mission 1 1 in the 
schedule for the first 2 years of Shuttle flights. The purpose of this 
Shuttle mission is to deliver the first ATE, equipped by the Langley 
Research Center, to orbit and perform a 7-day Sortie mission. The 
ATL payload will make use of the space environment (e. g. , high altitude 
and velocity, weightlessness, and radiation) to develop and test a wide 
variety of advanced technology systems and techniques. 

The flight hardware for this cargo consists of the following 
major elements: 

• Transfer Tunnel 

• Core/Experiment Segment 

• Rack/Floor Assemblies 

• Pallet 

• ATL and Contamination Monitoring Experiments 

Sketches showing the ATL, location of ATL/Spacelab in 
Orbiter,and ATL/Spacelab Pallet configuration for this mission are 
presented in Figures Z through 4. This configuration provides a 
pressurized volume for support systems and experiments and a pallet 
for mounting experiments to be conducted in the environment of space. 

The experime nt/ palle t/ module groups can be handled as an integrated 
unit and can be installed in or removed from theOrbiter as a unit. 

2.1.1 ATL and Contamination Monitoring Fxperiments 

The payload for this flight consists of 13 experiments selected 
from ATL payloads and the IRTCM experiment. The experiment payload 
consists of the following experiments: 

• Microwave Interferometer Navigation and Tracking Aid 

, Autonomous Navigation 
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FIGURE 2. ADVANCED TECHNOLOGY LAB 
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FIGURE 3. ATL/SPACELAB LOCATION IN ORBITER 



FIGURE 4. ATL/SPACELAB/PALLET CONFIGURATION 
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• Search and Rescue Aids 

• Imaging Radar 

• Lidar Measurement of Cirrus Clouds and Lower 
Stratospheric Aerosols 

• Ultraviolet Meteor Spectroscopy from Near Earth 
Orbit 

• Colony Growth in Zero Gravity 

• Interpersonal Transfer of Microorganisms in Zero 
Gravity 

• Electrical Characteristics of Cells 

• Special Properties of Biological Cells 

• Zero Gravity Steam Generator 

• Sampling of Airborne Particles and Microorganisms 

in Space Cabin Environment 

• Environmental Effects on Nonmetallic Materials 

• IRTCM. 

2. 1. 2 Summary of Hazardous Materials/System s 

The Spacelab/ ATL/ IRTCM cargo will require checkout and 
servicing during processing. The following hazardous materials/ systems 
are carried by this cargo and are of concern in processing: 

• Electrical 

• Radar 

• Laser 

• Freon 

• Steam Generator (water and silicone) 
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• High Pressure GN2 

• Pyrotechnics (boom jettison systems) 

• High Pressure GO2 

• Microorganisms 
PROCESSING SCENARIO 

The Spacelab/ATL/IRTCM processing scenario is presented 
. This scenario presents the following sequence of operations; 


The ATE experiments and experiment peculiar GSE 
are off-loaded at the KSC air strip and transported 
to the OSjC Building where they are inspected, 
functionally tested, and integrated with the Spacelab 
elements. 

The integrated Spacelab/ATL/IRTCM is transported 
to the Orbiter Processing Facility (OPF) where it is mated 
to the Orbiter and the Orbiter integrated tests are conducted. 

The Orbiter / cargo is then moved to the Vertical Assembly 
Building (VAB) for Shuttle final assembly and verification. 
After verification, the mobile launcher platform is moved 
from the VAB to the pad. 

At the pad, the experiment time critical elements 
are installed, final servicing is conducted, and 
countdown is initiated. 

After normal mission flight and in-flight safing 
ope rations, the Orbiter lands at the Orbiter airstrip 
where safing operations are conducted. 

The Orbiter is moved to the OPF where the time 
critical elements and Spacelab are removed from the 
Orbiter. 
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• The experiment elements are removed and the 
Spacelab is disassembled in the O&C. The 
experiment elements are prepared for trans- 
porting and are returned to their respective 
vendors for refurbishment. The Spacelab 
elements are refurbished and either sent to 
storage, or put back into operation. 

In addition to the normal processing scenario discussed, 
six contingency situations are presented. Two contingency situations 
at the Pad are shown: 

• Backout Operations 

• Vertical Changeout 

The third contingency, Mission Abort, is shown as an 
alternative to the normal in*flight operations. The fourth, fifth and 
sixth contingencies are: 

• Normal Landing at Contingency Site 

• Crash/Shock Condition Landing at KSC 

• Crash/Shock Condition Landing at Contingency Site 

These are presented as alternatives to the normal landing 
operations at KSC and contingency flow plans for these situations are 
included in Volume 4. 

Z. 3 PROCESSING FLOWS 

This section presents the Spacelab/ ATL/IR TCM Launch Site 
Processing Flow Plans that were derived during this study. These flow 
plans identify each major operation necessary to prepare the payload 
for flight and post-flight refurbishment and acknowledge the payload 
hazardous parameters that exist during these operations. 
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A top-level flow was developed to show individual payload 
operations, cargo operations, launch operations, and post-launch 
operations. This top-level flow is essentially an index of operations at 
different areas and was expanded into a second level flow,w^hich is a 
detailed operational sequence for each cargo. Development of this flow 
was an iterative process, and through a series of iterative tradeoffs 
the normal base line processing flow plans were formed. 

2, 3. 1 Top Level 


While the scenario for the Spacelab/ ATL/ IR TCM cargo shows 
basic and essential operations to enable its processing, a slightly different 
format was established to be used as a top level functional flow. The 
top-level Spacelab/ATL/IRTCM Launch Site Processing Flow Plan shown 
in Figure 6 is an index of processing operations. This figure show'S 
six major areas that provide convenient breakouts for the second level 
functional flows and have been addressed at the first level. The six 
major areas are: 

• Payload Launch Site Processing 

• Payload/Orbiter Integration and Verification 

• Pad and Launch Operations 

• Orbiter/Payload Post-Flight Operations 

• Payload Launch Site Post-Mission Processing 

• Spacelab/ Pallet Refurbishment Operations 

2. 3, 2 Normal Base Line 

The Spacelab/ATL/IRTCM second level functional flow 
diagram referred to as the normal base line processing flow is an 
expansion of the first level with sufficient details to enable a hazards 
analysis to be performed from the second level functional event sheets. 

The Normal Base line Processing Flow represents the output 
of an iterative process. Many feasible options in sequencing certain 
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activities were examined to weigh their respective advantages and dis- 
advantages considering the parameters of safety, time, and facilities. 
Through this process some hazardous operations were either eliminated, 
reduced, or replaced by less hazardous ones, or the sequence and/or 
locations changed so as to have a lesser impact. This process led to 
the evolvement of the normal base line processing flow. For each 
individual item on these flows, a functional event sheet was prepared 
to define the operation to a level necessary to identify all hazards, 
estimate operations times, and identify GSE, 

Certain basic assumptions were made during the formulation 
of the normal base line processing flows: 

• It is assumed that an ordnance jettison system 
will be included in experiment design to eject 
the extended portions of experiments if they 
are not able to retract at the end of experiment 
ope rations. 

• It is assumed that all these pyrotechnic devices 
can be installed and connected in the horizontal 
position prior to Orbiter payload bay door 

do sing. 

The Normal Base line Processing Flow for the Spacelab/ 
ATL/IRCTM is shown in Figure 7. This processing flow covers the 
Spacelab processing from receipt at KSC through launch, landing, and 
refurbishment. Hazardous operations and hazard sources are indicated 
for each operation. 

Hazardous operation, hazardous system activation, 
or termination of hazardous system operation. The 
hazard source and reference hazard analysis are 
shown. 

Initiation of a hazardous operation or loading of a 
hazardous system which continues throughout sub- 
sequent processing operation or until terminated. 

The hazard source and reference hazard analysis 
are shown. 
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2*3.3 Major Options to Normal Base Bine and Tradeoff Studies 

In the development of the normal base line processing flows, 
alternate flow plans were studied and analyzed to develop the optimum 
operational sequence of flow for processing the Spacelab/ATL/IRTCM 
cargo. These options present areas of the normal baseline processing 
flow concept that required additional study and tradeoff to ensure the 
selection and development of the most feasible and time/cost effective 
as far as safety aspects are concerned. 

An area of concern for this cargo was the experiment 
biological specimen loading approach. Two options to the selected 
normal base line concept were investigated: 

• Load specimens at OPF with Orbiter in horizontal 
position, 

• Provide specimen refrigerator in Orbiter cabin. 

The first alternate specimen loading approach is to load the 
specimens while in the OPF and in the horizontal position. This alternative 
requires continuous power to the Spacelab until launch, which is a potential 
hazard. It also requires monitoring the environment around the 
specimens until launch. 

The other alternate approach would require the addition of 
a specimen refrigerator in the Orbiter cabin for storage during launch, 
after which the crew would carry the specimens to the ATL refrigerator 
under zero-g conditions. Here, of course, there are space and weight 
impacts on the Orbiter. The advantages of this method are that loading 
can be performed at the time of crew boarding. Removal can be performed 
during flight/crew exchange at the landing area. The disadvantage of this 
approach from a safety viewpoint is. that if the biological samples are 
inadvertently released, the Orbiter cabin atmosphere can be contaminated. 

2.4 FUNCTIONAL EVENT DESCRIPTION 

The purpose of these functional event sheets are to describe 
each Spacelab/ ATL/IR TCM processing operation, give the sequence 
of events required to complete the operation, and estimate the time 
required. For each event in the operation, potential hazardous conditions 
are noted and cross-referenced to a hazards analysis, GSE and facilities 
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associated with this operation are also shown. Hazardous materials 
or systems loaded or activated in a previous operation are indicated by 
hazard category. 

The operation sequence of events portion of these functional 
event sheets defines each of the Spacelab/ATL/IRTCM normal base line 
processing flow operations to a level necessary to identify all hazards, 
estimate operations times, and identify GSE. Fifty-seven normal base 
line processing flow operations were identified for the Spacelab/ ATL./ 
LRTCM cargo. Potential hazardous conditions were identified as being 
associated with 17 of these 57 operations. 

The functional event sheets for the Spacelab/ATL/IRTCM 
normal base line processing flow operations are included in Appendix A. 

2. 5 WATERFALL/ TIME LINE 

The Spacelab/ATL/IRTCM Waterfall/ Time Line provides a 
visual guide to the series and parallel relationship of the various pro- 
cessing flow operations. The processing flow operations were base 
lined early in this study in accordance with KSC Spacelab Operational 
Turnaround Allocation, August 28, 1974, These time lines were not 
updated by subsequent changes or modifications to the operational 
allocations since these changes were not detrimental to the results of 
this study. 


The numbers and titles appearing on the events refer to the 
Spacelab/ATL/IRTCM normal base line processing flow diagram item, 

2. 5, 1 Normal Base Line 

The normal base line processing flow time line for the Spacelab/ 
ATL/IRTCM cargo is illustrated in Figure 8, This cargo is received, 
checked out, and assembled in the O&C Building at KSC. This cargo is 
then moved to the OPF to be installed in the Orbiter cargo bay at 
approximately 91 hr prior to launch. The on-line processing operations 
require approximately 27 hr in the OPF and 38 hr in the VAB, The time 
at the pad for the cargo is approximately 17 hr. 

Operations of interest for this cargo are loading an unloading 
of the biological specimens. These specimens must be refrigerated 
continuously. Therefore, they are not loaded until about T-4 hr, when 
the pad is opened after Orbiter servicing. At this time the spacecraft 
has power and the refrigerator is operational. Removal of the specimens 
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is accomplished when the payload doors are opened in the OPF. Power 
and monitoring are required onboard until the specimens are removed. 

2. 6 GSE AND FACILITY REQUIREMENTS 

This section presents the major GSE and facility requirements 
for processing operations that have been identified as a result of the 
processing flows. These items are recognized as essential for the 
successful processing of the cargo. 

Any experiment unique GSE will be furnished by the user, 
with the possible exception of transportation items or other items KSC 
may agree to furnish upon request. It was originally planned that specific 
experiment equipment would also be identified. However, there is insuffi- 
cient information available to be definitive of particular experiments. 

Some facility requirements were envisaged to support different experi- 
ment groups, however. 

For the Spacelab/ATL/IRTCM cargo, a support equipment 
listing of required equipment to meet specific processing requirements 
and functions was prepared. From this listing, support equipment identi- 
fication sheets were prepared for servicing equipment and facility items 
that were new, peculiar, or associated with hazardous operations. 

The support equipment listings were separated into facility 
equipment, identified with a *'F” number, and a Spacelab cargo, identified 
with a number. The "S’' identification was further divided into 
servicing, handling and access, electrical, transportation, and mis- 
cellaneous by the addition of a appropriate second letter. 

For the Spacelab/ATL/IRTCM cargo, 11 items of facility 
equipment and 66 items of support equipment have been recognized as 
a result of the processing flows. From this listing, support equipment 
identification sheets were prepared for 13 items. The title, basic 
function, and description of these items are shown on these sheets. The 
support equipment listing for the following Spacelab/ATL/IRTCM equip- 
ment categories are included in Appendix D. 

• Facility 

• Spacelab Electrical 
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• Spacelab Handling and Access 

• Spacelab Tunnel Handling and Access 

• Spacelab Servicing 

• Spacelab Tunnel Servicing 


2.7 PROCESSING HAZARDS SUMMARY 

Ten hazard types have been identified with 17 operational 
events in the Spacelab Normal Base Dine Processing Flow. These hazard 
types, their HMEA number, the frequency with which they occur, and the 
final hazard categorization after the application of hazard reduction 
methods are as follows: 


Hazard Types 

HMEA 

Number 

F requency 
of Occurrence 

Final Hazard 
Categorization 

GN 2 Purge 

H002 

1 

Controlled 

High Pressure GN^'’' 

H004 

5 

1 Controlled 

Electrical Power 

H006 

6 

4 Catastrophic 
Controlled 

Daser s 

HOO 9 

2 

Controlled 

F reon'*' 

H012 

3 

Controlled 

Pyrotechnics - - Armed'! 

= H017 

2 

Controlled 

Radar 

H034 

2 

Controlled 

Steam Generator 

H035 

2 

Controlled 

High Pressure GO^'*' 

H036 

2 

Catastrophic 

Microbiological'*' 

H037 

3 

Controlled 


'•‘Continue or carry over to other operations and present the 
possibility of interface or interaction effects during subsequent 
operations. 

2.7,1 Hazard Mode and Effects Analysis 


Functional Event Sheets for the Spacelab Normal Processing 
Base line flagged each hazardous operation for a hazard analysis. By 
examining each operational event (where a hazard or hazards had been 
uncovered) in conjunction with the HMEA of that type of hazard (e. g, , 
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laser and electrical), a determination of the initial hazard impact on 
the payload, cargo, facilities, Orbiter, and personnel was made. The 
impact whether catastrophic, critical, or controlled and what was 
affected, such as payload and cargo, was indicated on the Normal Pro- 
cessing Base Line Flow along with the final categorization that shows 
the result after the application of control measures listed on the HMEA 
for that hazard type. The HMEA’s for the 10 hazard types shown in 
paragraph 2. 7 are located in Appendix E. 

2, 7. 2 Interface Hazards 


If the hazard were a "one event only" hazard, it was indicated 
by a hexagon on the processing flow chart. If the hazard were one that 
would continue over several operational events, it was indicated by a 
circle and a line was run from the source event to the terminal event 
where the hazard was closed out with a hexagon. Events containing 
more than one hazard may have interface hazards associated with them, 
and also, events where hazards are continued from previous events 
operating on or operated on by an event initiated hazard can also have 
interface hazards. In this manner, the processing flow clearly shows 
all possible hazard interactions for each operation. 

An interface hazard represents a potential accident type that 
could occur if one hazard source were to go out of control (an accident) 
and operate on another hazard source causing it to go out of control. In 
accidents resulting from an interface, the combined effects are often 
different and/or worse than the singular uncombined effects of either. 

In Spacelab/ATL Normal Base Line Processing Flow, two 
events present interface potential. These are as follows: 

• Event 2, 03--Interface Connect and Verify 

# Event 2. 05--Orbiter Integrated Tests 

In both of these events, power is applied to make checks and 
verification of various electrical networks. Inadvertent activation of 
the laser, radar, or steam generator has the potential of injuring 
personnel and/or damaging the cargo and the Orbiter. 
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Z. 8 SAFETY REQUIREMENTS AND LAUNCH SITE PROTECTION 

Identification of the 10 types of hazards associated with the 
Spacelab Normal Base Line Processing Flow has presented the requirement 
for providing recommendations and/or preventative measures that could 
help to alleviate the sever ity/ occur rence of the hazard. The detailed 
safety, operational and facility requirements for each of these 10 
hazards are presented in Appendix E. A summary of the more pertinent 
requirements that have been established for each of the identified hazards 
are : 


• GN^ Purge (HOOZ) 

The prevention of personnel injury from asphyxiation 
can be effected most readily by limiting the access of 
personnel to areas where purge operations are being 
conducted, and to provide proper ventilation or self- 
contained breathing apparatus for those persons that 
must enter the area. Proper use of restraints or 
tiedowms and vent/ relief capability can help preclude 
rupture of high pressure vessels and lines, and 
thereby prevent damage to personnel and equipment 
caused by whipping of unsecured lines, etc, 

• High Pressure GN£ (H004) 

High pressure testing or checking of tanks/lines/fittings 
always presents the hazard of a rupture or burst that 
could result in personnel injury and damage to facilities 
and equipment. Remote operation or where required, 
provision for restricted access and appropriate caution 
and warning procedures can considerably reduce the 
exposure of personnel to such hazards. 

• Electrical Power (H006) 

Probably the single most effective means for preventing 
electrical shock to personnel is through the use of 
Ground Fault Interrupter (GFI) devices. The use of 
proper operational procedures, checklists, and safety 
interlocks will help prevent the inadvertent creation of 
associated electrical hazards, such as arcing and high 
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voltage discharge, which can result in fires 
and damage to equipment. 

• Laser (H009) 

A laser checkout facility should be used to limit access 
to the area during testing, and to provide barriers 
and curtains to contain the reflected light. Eye shields 
should be worn at all times during tests with lasers. 

• Freon (H012) 

Adequate facility ventilation and avoidance of smoking 
or open flames in the area where halocarbon vapors 
may be present should preclude most hazardous 
conditions to personnel from these materials. 

• Pyrotechnics- -Armed (H017) 

Before removing shorting caps from Electro Explosive 
Devices (EED^s) and connecting pyrotechnic devices, 
checks should be made for RF or magnetic fields and for 
energized electrical connectors. Only essential personnel 
should be allowed when Class A pyrotechnics are being 
installed, checked out, and connected, 

• Radar (H034) 

Control of this type of electromagnetic radiation is 
most important to avoid personnel injury and initiation 
of unprotected pyrotechnic devices. The most obvious 
and effective measures for controlling this radiation are 
to provide covers for the equipment (antennas) when 
not in operation and to provide physical barriers to 
limit access during operations. 

• Steam Generator (H035) 

Safety/ operational requirements for operation of the 
steam generator point out the need to verify the tank 
integrity before use and to limit access to the area 
during first checkout. 
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• High Pressure GO^ (H036) 

Primary safety/operational requirements for working 
with high pressure gaseous oxygen in addition to the 
more obvious hazard of this material in contact with 
combustible materials such as grease, oils, etc,, 
are the need for limiting access during operations 
and verification of tank integrity before use. 

• Microbiological (H037) 

Safety requirements when working with microbiological 
specimens necessitate certain precautions for the 
protection of personnel, such as adherence to proper 
operational and/or laboratory safety techniques, 
wearing protective masks, use of hoods, gloved boxes, 
etc. 

2.9 PAYLOAD SAFETY RELATED RECOMMENDED CRITERIA 

Identification of the 10 types of hazards associated with the 
Spacelab Cargo Normal Base Line Processing Flow has also presented 
the requirement for providing pertinent payload design criteria that 
could help to reduce the severity or occurrence of the hazard. The 
detailed criteria set forth for each of these hazards are provided in 
Appendix E. A brief summary of the more significant criteria 
emanating from this study are presented below: 

m GN^ Purge (H002) 

No payload design requirements were found to be 
applicable to this hazard. 

• High Pressure GN 2 (H004) 

All high pressure tanks should be designed with pressure 
relief valves to limit pressure and the tanks should be 
designed to limit shrapnel in case of a inadvertent 
rupture or burst. Pressurized flight systems should 
be connected to the Orbiter vent system to allow venting 
before returning from Orbit, 
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• Electrical Power (H006) 

All electrical equipment, connectors, etc. should 
conform to the provisions of the National Electrical 
Code and the applicable NASA and MIL Standards. 

The designs of safety critical switches and controls 
should be such that they are readily accessible in the 
event of a major incident. 

• Laser (H009) 

Safety related design features for laser operations 
should include electrical/mechanical interlocks to 
prevent inadvertent energizing, limits or stops to 
limit pointing direction, and a C&W system to provide 
a warning if the beam is out of limits. 

• Freon (H012) 

All systems using pressurized gases should include 
provisions for the relief of overpressure and for the 
venting of the systems in orbit, 

• Pyrotechnics- -Armed (H017) 

Ordnance firing circuits must be designed so that 
after one failure, a second failure will not fire the 
circuit. The payload design should include the 
location of the pyrotechnic initiators for easy accessi- 
bility when the cargo is in the Orbiter bay. Shielding 
of all leads from stray RFI is required. 

• Radar (H034) 

Design of this equipment should include the incorporation 
of power /lockout devices in addition to on/ off switches 
to ensure that no single failure can cause inadvertent 
operation. 
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• Steam Generator (H035) 

Safety design criteria most pertinent to the steam 
generator should include the use of a power /lockout 
device in addition to on/ off switches to ensure that no 
single failure can cause inadvertent operation# and 
a steam relief valve connected to the Spacelab vent 
system should be incorporated. The experiment 
design should include a containment structure. 

• High Pressure GO 2 (H036) 

Tanks should be designed with appropriate safety 
factors, pressure relief devices to limit pressure, 
and flight article tanks should be designed to limit 
shrapnel. 

• Microbiological (H037) 

The design of biological specimen packaging should 
include provision for release of a neutralizing agent 
(a biocide, etc. ) in case of specimen release from 
the test tubes or vials. 
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3.0 IUS/F2PU/PJP CARGO PROCESSING PLAN 


3. 1 CARGO DESCRIPTION 

The IUS/F 2 PU/PJP cargo consists of an expendable 
hypergolic lUS, a F^PU, and a PJP* Each element composing this cargo 
is expendable. The basic mission objective is to transport the PJP to 
Jupiter to explore its atmosphere structure to a depth of 10 bars. 


3* !• 1 Pioneer Jupiter Probe 


The basic mission objective of the PJP is to determine 
Jupiter's atmosphere structure and composition to a depth of 10 bars, to 
determine the location and composition ^ ^ clouds around Jupiter, and to 
measure interplanetary environment. 

The mission objectives are met with a spin stabilized space- 
craft that is composed of two basic units; a bus and an entry probe. The 
bus with its attached entry probe will fly to Jupiter, The probe will 
be aimed at Jupiter and released from the bus, which on its flyby will 
act as a relay to transmit the data the probe is recording to earth. 

The PJP configuration is as shown in Figure 9. The bus 
unit of the PJP contains the following systems: 

• Structure (Equipment Compartment, Booms, and 
Honeycomb Antenna) 

• Environmental Control (Passive Louvers and 
Insulation) 

• Guidance, Navigation, and Control (Sun and Star 
Tracking and Ground RF Command) 

• Propulsion (Velocity Control through Thrusters 
with Hydrazine Propellant) 

• Attitude and Spin Control (Thrusters with Hydrazine 
Propellant) 
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FIGURE 9. PIONEER JUPITER PROBE CONFIGURATION 
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• Tracking and Command (X&S Band TLM and 400 
MHz Probe Relay Link) 

• Electrical (RTG Power) 

• Experiments 

• Separation (Bolt Cutters and Associated Ordnance). 

The bus will collect the following type of data: 

• Photograph planet cloud surface with its Multispectral 
Line Scan Camera. 

• Planetary atmosphere temperature, pressure, and 
composition with its IR radiometer, IR spectrometer, 
and its UV photometer, 

• Planetary internal structure and trapped radiation as 
well as interplanetary/inter stellar magnetic field/ 
wind/cosmic rays with its magnetometer, solar 
wind analyzer, and charge particle detector. 

• Meteoroid flux versus size in space and near Jupiter 
with its 12 penetration panels. 

The Entry Probe Systems are: 

• Structures (Equipment Compartment) 

• Telemetry 

• Experiments 

— Atmospheric composition with its Quadropole 
Neutral Mass Spectrometer 

--Atmospheric temperature with its thermocouple 
temperature gage 

--Atmospheric pressure with its transducer pressure 
gage 
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-- Atmospheric density with its 3-axis accelerometer 

-- Cloud density and altitude with its light source 
nephelometer detector, 

3, 1, 1, 1 Summary of Hazardous Materials/Systems 

The general hazards associated with the PJP are as follows: 

• Electrical 

• Radiological--RTG's and Radioisotope Heater Units (RHU’s) 

• Hype rgolic - -Hydrazine 

• Fire / Explosive- -Pyrotechnics, Batterie s 

• High Pres sure--GN 2 and GHe 

• High Temperature--R TG* s 

• RF (Communications), 

3,1,2 Fluorine Propulsion Unit 

This conceptual propulsion unit is a basic blowdown type 
and is composed of a closed loop cooled fluorine oxidizer system 

with mono-methyl hydrazine as its fuel element. The propellant capacity 
is conceived to be between 1,500 and 3, 000 lb. The ratio of propellants 
is approximately 2/3 F 2 and 1/3 N 2 H 4 ,with tank operating pressure at 
approximately 350 psig. The F 2 tank is insulated with Polyurethane 
Foam and has an internal LN 2 cooling coil system. The EN 2 cooling 
supply can be removed for 3 to 6 hr during normal operations without 
the loaded F 2 tank becoming overpressurized. The F 2 PU receives its 
commands through the PJP, thus allowing a very simple and straight 
forward design. The design configuration of this fluorine stage has not 
been fully developed and is based on a preliminary concept only. 

This propulsion unit contains the following major systems: 

0 A closed loop F 2 oxidizer system with fill and vent 
capabilitie s 
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• A l-rN^ cooling system for the F 2 tank 

• A mono-methyl hydrazine fuel system with fill 

and drain capabilities 

• An engine system 

• A spin/despin and separation system 

• A structure system 

3. 1. 2. 1 Summary of Hazardous Materials/Systems 

The general hazards associated with this propulsion unit are: 

• Hypergolic - -Mono -Methyl Hydrazine 

• Hypergolic/Cryogenic- -Fluorine 

• High Pressure --GN^, GHe 

• Pire / Explosive - -pyrotechnic s 

• Electrical 

• Cryogenic --LN 2 Cooling 

3. 1*3 Interim Upper Stage 

The lUS is a three-axis stabilized stage with guidance using 
storable propellants and pressure-fed engines designed to deliver a 
5, 000 lb payload from low earth orbit to synchronous orbit and to escape 
velocity. The expendable lUS is a 120-in. diam 2 30 -in, long stage 
that has a utility life limit of 8 hr. The lUS/Payload mounted in the 
Orbiter cargo bay rests in a cradle that is attached to four Orbiter mount 
fittings. The lUS has an umbilical connection to the cradle that is separated 
before the Orbiter Remote Manipulating System (RMS) lifts the lUS/payload 
free of the cradle, out of the cargo bay, to a release point above the Orbiter. 

The lUS configuration is shown in Figure 10, A general 
description of the lUS systems follows: 

• Attitude Control System (ACSh Monopropellant 
hydrazine stored under helium pressure in spherical 
tanks. 
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• Electrical Power System (EPS): Battery with vent 

operates with GH 2 under normal operation and produces 
KOH during failure mode, 

• lUS Main Propulsion System (MPS) : Main propulsion 

system provides 16, 000 lb maximum thrust. The 

main propellant, UDMH/N 2 H^ and N 20 ^ are pressurized 
from the helium pressurization system. 

Other systems to be checked out during ground processing 
include instrumentation, communication, data management, guidance, 
navigation, and control system. 

3. 1,3. 1 Summary of Hazardous Materials/Systems 

The lUS contains the following general hazards: 

• Oxidizer 
2 4 

• and UDMH/N^H^ 

2 4 2 4 

• Batteries 

• ^^2 Helium 

• Electrical 

• R E- -Communications. 

3.2 PROCESSING SCENARIO 

The IUS/F 2 PU/PJP processing scenario shows a likely 
sequence of operations essential to process this cargo for the prelaunch 
and launch phases of its operational cycle. Buildings and areas have been 
identified that most reasonably accommodate the major operations 
required to process the individual elements (lUS/ F 2 PU / PJP) of this 
cargo as well as those for the combined cargo. 

Throughout the analysis there has been a continuous endeavor 
to evolve the best practical sequence of activities for a reasonably safe 
and timely set of prelaunch and launch processing plans. This has been 
reflected in our selection of the relative placement of activities with 
respect to one another and the location where performed. 
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The scenario (Figure 11) covers the full cycle of operations 

as follows: 

• The PJP is off-loaded at KSC airstrip and moved 
from the airstrip to the AO Hanger where it is 
inspected, shipped loose parts assemblied, functionally 
tested, and leak checked. 

• The F 2 PU and lUS are off-loaded at KSC airstrip 

and transported to SAEF #1 where they are inspected, 
shipped loose parts assembled, functionally tested, and 
leak checked. The lUS APS is loaded at SAEF #1 
where in the case of F^PU and PJP, the APS is 
loaded and test fired in Propellant Lab 6 OA, 

p After APS test firing, the F 2 PU is transferred to 

the fluorine facility where fluorine is loaded and the 
system stabilized. The F 2 PU and PJP are then 
moved to SAEF #1 where they are mated with the lUS. 

m The mated cargo is moved to the pad and lifted from 
the transporter into the PCR. 

• The cargo is then loaded into the Orbiter bay and 
Orbiter /cargo interfaces are mated and verified. 

The RTG's that were off-loaded, received, inspected, 
and tested at the SAEF #1 area in Building M7-147Z 
are now installed in the cargo and tested. The Orbiter 
bay is closed, PCR is retracted, and countdown is 
initiated. 

In addition to the normal processing scenario discussed, 
three contingency situations are presented. Two contingency situations 
at the pad are shown: 

• Backout Operations 

• Vertical Changeout at Pad 

The third contingency. Mission Abort, is shown as an alter- 
native to the normal in-flight operations. 

The flow plans for these contingency situations are included 
in Volume 4. 
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3.3 PROCESSING FLOWS 

This section presents the lUS/F^PU/PJP Launch Site Pro- 
cessing Flow Plans that were derived during this study. These flow 
plans identify each major operation necessary to prepare the payload 
for flight and acknowledge the payload hazardous parameters that 
exist during these operations, 

A top-level flow was developed to show individual payload 
operations, cargo operations, and launch operations. This top-level 
flow is essentially an index of operations at different areas and was 
expanded into a second level flow that is a detailed operational sequence 
for each cargo. Development of this flow was an interative process and 
through a series of iterative tradeoffs, the normal base line processing 
flow plans were formed, 

3,3,1 Top-Level 

While the scenario for the IUS/F 2 PU/PJP cargo shows basic 
and essential operations to enable its processing, a slightly different format 
was established to be used as a top-level functional flow. The top level 
IUS/F 2 PU/PJP Launch Site Processing Flow Plan is shown in Figure 12. 
This figure shows six major areas that provide convenient breakouts 
for the second level functional flows and have been addressed at the first 
level. The six major areas are: 

• 1,0 Premate lUS Processing 

• 2.0 Premate F 2 PU Processing 

• 3. 0 Premate PJP Processing 

• 4. 0 IUS/F 2 PU/PJP Integration 

• 5.0 Cargo to Orbiter Integration and Pad Operations 

• 6. 0 Premate RTG Processing 

3, 3, 2 Normal Base Line 

The IUS/F 2 PU/PJP second level functional flow diagram 
referred to as the normal base line processing flow is an expansion of 
the first level with sufficient details to enable a hazards analysis to be 
performed from the second level functional event sheets. 
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The Normal Base Line Processing Flow (Figure 13) represents the 
output of an iterative process. Many feasible options in sequencing certain 
activities were examined to weigh their respective advantages and dis- 
advantages, considering the parameters of safety, time, and facilities. 

Through this process some hazardous operations were either eliminated, 
reduced, or replaced by less hazardous ones, or the sequence and/or 
locations changed so as to have a lesser impact. This process led to 
the evolvement of the normal base line processing flow. For each 
individual item on these flows, a functional event sheet was prepared to 
define the operation to a level necessary to identify all hazards, estimate 
operations times, and identify GSE. 

Certain basic assumptions and criteria were established 
during the formulation of the normal base line processing flows. These 
are discussed as follows: 

• SAEF #1, or another Tug processing facility, 
would handle processing of the Tug, lUS, and 
cargo mating operations. 

• The Shuttle payload flow at KSC would require 
utilization of all available facilities. Propellant 
Lab 60A would be used for some off -pad payload 
propellant loading, and APS propellants for some 
payloads would be loaded in this facility. 

• Upper stages and payload APS systems would 

be test fired to verify operations and wet system 
seals before launch. 

• Propellant Lab 60A will not handle a lUS/F^PU/ 

PJP cargo or a Tug/SEPS/SEOS cargo because 
of size limitations. 

• The Tug and lUS and their cargoes would be 
processed in the vertical position. 

• The Tug and the lUS and their cargoes would be 
mated into the Qrbiter at the pad through the 
payload changeout room. 
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FIGUPE 13. NOPMAL BASE LINE PPOCESSING FLOW FOR THE lUS/F.PU/PJP CARGO (Sheet 1 of 5) 
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3.3,3 Op tions to Normal Base Line 

3. 3. 3.1 Fluorine Loading 

Many options are available for loading the fluorine 
oxidizer in the F 2 PU payload. The first option studied was loading at 
the pad in the Orbiter bay. An alternate pad loading option that had 
been considered by other fluorine studies was loading in the payload 
changeout room. Both of the options were investigated from a time and 
hazards standpoint and were found to be impractical. 

The primary problem with fluorine loading operations is the 
severe consequences of a spill or leak that is most likely to occur 
during propellant transfer. Fluorine reacts with most materials and 
is extremely corrosive to many metals. Also, the consequences 
of a major spill would have a pronounced effect on the environment and 
pose a hazard to personnel in the area and to the general public. The hazards 

of fluorine operations alone are sufficient to reject pad loading, but the 
time required to passivate, load, and thermally balance the LF ^ tank 
is approximately 31 hr. This time prohibits loading in the cargo 
bay regardless of hazards and would tie up and restrict access to the 
pad area for 31 hr if the payload changeout room were used for loading. 

For these reasons, it was determined that all fluorine loading 
operations should be performed off-line in a remotely located facility 
designed especially for controlling hazardous fluorine operations. 

The next fluorine processing option to be considered is where 
in the processing cycle the fluorine is to be loaded. The obvious 
choice is to perform all cargo integration functions and load the fluorine 
just before the cargo is ready for transport to the payload changeout 
room. This option minimizes the handling and exposure of personnel 
to the fluorine stage. However, considering the extremely corrosive 
effect of F^ vapors on electronic and electrical equipment and that the 
highest likelihood of F^ vapors being present is during the F^ passiva- 
tion and loading it was concluded that lUS and PJP critical electronics 
damage would be likely using this approach. Also, loading F 2 after 
integrating the payloads would result in the cargo having to repeat most 
of the testing performed during earlier payload and cargo testing. This 
repeat testing would require as much personnel exposure to F 2 as the 
approach selected and almost double the required cargo testing. If a 
circuit were effected by F 2 vapors during loading, to repair or 
replace the element would also prolong the processing time and increase 
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personnel exposure to F 2 . However, after a F 2 system is properly 
passivated, loaded, and stabilized, the likelihood of F 2 vapors leaking is 
much smaller. These considerations resulted in our recommending 
loading of the F^ prior to integration with the other payloads. This 
recommendation is based on the assumption that the LF 2 tank cooling 
concept can maintain the cryogenic fluorine pressure near atmospheric 
pressure. This may require a pressurization system for flight press- 
urization of the L»F 2 system. 

3, 4 FUNCTIONAL EVENTS DESCRIPTION 

The purpose of these functional event sheets is to describe 
each IUS/F 2 PU/PJP processing operation, give the sequence of events 
required to complete the operation, and estimate the time required. For 
each event in the operation, potential hazardous conditions are noted 
and cross-referenced to a hazards analysis, GSE and facilities associ- 
ated with this operation are also shown. Hazardous materials or systems 
loaded or activated in a previous operation are indicated by hazard 
category. 


The operation sequence portion of these functional event 
sheets defines each of the lUS/F^PU/PjP normal base line processing 
flow operations to a level necessary to identify all hazards, estimate 
operations times, and identify GSE. Seventy -nine normal base line 
processing flow operations were identified for the IUS/F 2 PU/PJP cargo. 
Hazardous conditions were identified with 46 of these 79 operations. 

79 operations. 

The functional event sheets for the IUS/F 2 PU/PJP normal 
base line processing flow operations are in Appendix B. 

3, 5 WATERFALL/TIME LINE 

The lUS/F 2 PU/PJP Wate rfall / T ime line provides a visual 
guide to the series and parallel relationship of the various processing 
flow operations and are time -phased to show the time allocation for each 
operation. The processing flow operations were base lined early in this 
study in accordance with KSC Shuttle /Tug Turnaround Allocation, 
December 16, 1974. These time lines were not updated by subsequent 
changes or modifications to the operational allocations since these 
changes were not detrimental to the results of this study. The numbers 
and titles appearing on the events refer to the IUS/F 2 PU/PJP functional 
flow diagram item numbers. 
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3. 5. 1 Normal Base Line 


The normal base line processing flow time line is illustrated 
in Figure 14. This time line shows the complete flow of each element 
of this cargo from arrival at KSC to launch. This time line includes 
approximately 5 5 hr prior to Or biter landing for off-line receipt, inspec- 
tion, and assembly of the PJP. The lUS, PJP, and F^PU are individually 
followed (through SAEF #1, AO Hanger, F 2 loading facility, and Propellant 
Lab 6 OA) until they are mated into an integrated cargo at approximately 
52 hr prior to launch. The RTG's for this cargo are received and tested 
off-line and then mated to spacecraft on the pad. The pad time for this 
cargo is 30 hr. The Shuttle events for this time line are referenced but 
not identified. 

Fluorine loading for the F 2 PU elements is off-line because 
the loading and thermal balancing is very hazardous and loading off-line 
reduces the Orbiter, PJP, and lUS exposure to a hazardous operation. 

The decision to perform the F 2 loading off-line was based 
in part on the following considerations: 

• First, a good safety criterion is to isolate hazardous 
operations as much as practical, especially when the 
type of operation is not commonly performed and the 
experience level is low. Of particular concern here 
is the escape of extremely corrosive F 2 vapors and 
the damage it could cause to the Orbiter, lUS, or 
PJP electrical and electronic components. 

• Second, the 31 hr required to passivate, load, 
stabilize, and monitor the system integrity would 
have an adverse impact on the Orbiter time line if 
performed at the pad. 

3. 6 GSE AND FACILITY REQUIREMENTS 

This section presents the major GSE and facility requirements 
for processing operations that have been identified as a result of the 
processing flows. These items are recognized as essential for the 
successful processing of the cargo. 

Any experiment unique GSE will be furnished by the user, 
with the possible exception of transportation items or other items KSC 
may agree to furnish upon request. It was originally planned that specific 
experiment equipment would also be identified. However, there is 
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insufficient information available to be definitive of particular experi- 
ments. Some facility requirements were envisaged to support different 
experiment groups, however. 

For the lUS/F^PU/PJP cargo, a support equipment listing of 
required equipment to meet specific processing requirements and 
functions was prepared. From this listing, support equipment identi- 
fication sheets were prepared for servicing equipment and facility items 
that were new, peculiar, or associated with hazardous operations. 

The support equipment listings were separated into facility 
equipment, identified with a ’'F” number, and a powered cargo, identified 
with a "P^* number. The ”P^‘ identification was further divided into 
servicing, handling and access, electrical, transportation, and mis- 
cellaneous by the addition of a appropriate second letter. 

For the lUS/F^PU/PJP cargo, Z3 items of facility equipment 
and approximately 134 items of support equipment have been recognized 
as a result of the processing flows. From this listing, support equipment 
identification sheets were prepared for some items. The title, basic 
function, and description of these items are shown on these sheets. The 
support equipment listing for the following lUS/ F 2 PhI/ PJP equipment 
categories are included in Appendix D. 


I 

I 





• Facility 

• Electrical 

• Handling and Access 

• Servicing 

• Transportation 

• Miscellaneous. 

3. 7 PROCESSING HAZARDS SUMMARY 

Twenty -one hazards types have been identified with 46 pro- 
cessing operations in the IUS/F 2 PU/PJP normal base line processing 
flow. These hazard types, their reference HMEA number, the frequency 
with which they occur, and the final hazard categorization after appli- 
cation of hazard reduction methods are as follows: 
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Hazard Types 

HMEA 

Number 

F requency 
of Occurrence 

Final Hazard 
Categorization 

GN^ Purge'J' 

H002 

6 

Controlled 

GN High Pressure'-' 
He High Pressure^-' 

H004 

8 

Catastrophic 

H005 

6 

Catastrophic 

Electrical'*' 

H006 

13 

Controlled 

RF 

H007 

2 

Controlled 


H008 

2 

Critical 

Toxic Gas 

HO 14 

2 

Critical 

Pyrotechnics - -Safed'-' 

H015 

2 

Controlled 

Pyrotechnics- -Armed 

H017 

1 

Controlled 

Battery'*' 

H019 

1 

Contr olle d 

GN /He Pressurization 

H022 

1 

Critical 

_r-,_ , - 

GF 

H025 

1 

Critical 

LN^* 

H026 

5 

Controlled 

JLF 

Radiological'*' 

H028 

2 

2 Critical 

H029 

1 

Controlled 

Krypton 85 

H030 

2 

Controlled 

LF^ Overpressure 

H031 

5 

4 Critical and 1 

High Temperature'*' 

H032 

1 

Catastrophic 

Controlled 

Radiological 

H033 

1 

Controlled 

RF 

H034 

1 

Controlled 

N^ 04 =:< 

H038 

2 

1 Controlled and 


1 Critical 


Also, carry over to other operations and present the possibility of 
interface or interaction effects during subsequent operations. 

3. 7. 1 Hazard Mode and Effects Analysis 


Functional Event Sheets for the lUS/F^PU/PJP Normal 
Processing Base Line flagged each hazardous operation for a hazard 
analysis. By examining each operational event (where a hazard or 
hazards had been uncovered) in conjunction with the HMEA of that type* 
of hazard (e. g. , laser and electrical), a determination of the initial 
hazard impact on the payload, cargo, facilities, Orbiter, and personnel 
was made. The impact whether catastrophic, critical, or controlled and 
what was affected, such as payload and cargo, was indicated on the Normal 
Processing Base Line Flow along with the final categorization that shows 
the result after the application of control measures listed on the HMEA 
for that hazard type. The HME A* s for the 21 hazard types are located 
in Appendix E. 
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On the Normal Base Line Flow, if a hazard were a "one event 
only" hazard, it was indicated by a hexagon. If the hazard were one that 
would continue over several operational events, it was indicated by a 
circle and a line was run from the source event to the terminal events 
where the hazard was closed out with another circle. Events containing 
more than one hazard may have interface hazards associated with them, 
and also, events where hazards are continued from previous events 
operating on or operated on by an event initiated hazard can also have 
iji^ 0 i'f 3 ,ce hazards. In this manner, all possible interaction possibilities 
from all hazard sources are clearly indicated for each operation. 

An interface hazard represents a potential accident type that 
could occur if one hazard source were to go out of control (an accident) 
and operate on another hazard source causing it to go out of control. 

In accidents resulting from an interface, the combined effects are often 
different and/or worse than the singular umcombined effects of either. 

In the lUS/F^PU/PJP Normal Base Line Processing Flow, 
several events present potential interface hazards. Examples of the 
major hazards are: 

• Leakage of fluorine can cause critical electronics/ 
electrical circuits to malfunction becaus‘=* of the 
corrosiveness of fluoride. This effect could cause 
critical and catastrophic failures of the cargo, payload, 
or Orbiter. 

• A fluorine leak into the fluorine tank heat exchanger 
could result in release of toxic F^ vapors through the 
LN^ cooling system vent. 

• Water leakage from the RTG cooling system could react 
violently with a fluorine leak after installation in the 
Orbiter. 

• Unfavorable weather conditions during transport of the 
F PU at the launch site could be a catastrophic hazard 
if a fluorine leak or spill occurs. 

Other interface hazards include inadvertent power applica- 
tion to the pyrotechnic devices or stray RFI could result in an explosion 
or fire. 
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The F^PU contains both LF 2 and N 2 H^ after loading the 
tank. The presence of these hypergolic materials through subsequent 
processing operations is a serious interaction possibility. With LF ^ as 
the oxidizer, a fire or explosion would be a certainty if the two were 
accidently mixed. The likelihood of leakage is reduced by applying 
only a blanket pressure to the APS*s and i-»F ^ tank until the cargo is 
ready to deploy from the Orbiter in space. 

3. 8 SAFETY REQUIREMENTS AND LAUNCH SITE PROTECTION 

Identification of the 21 types of hazards associated with the 
lUS cargo normal base line processing flows has presented the require- 
ment for providing recommendations and/or preventative measures 
that could help to alleviate the severity /occur rence of the hazard. The 
detailed safety operational and facility recommendations for each of 
these hazards is presented in Appendix E. A summary of the more 
pertinent requirements is as follows: 

• GN^ Purge {H002) 

Personnel injury from asphyxiation can be prevented most 
readily by limiting the access of personnel to areas where purge opera- 
tions are being conducted, and providing proper ventilation or self-con- 
tained breathing apparatus for those persons that must enter the area. 
Proper use of restraints or tiedowns and vent/relief capability can 
help preclude rupture of high pressure vessels and lines, and thereby 
prevent damage to personnel and equipment caused by whipping of 
unsecured lines, etc, 

• High Pressure GN^ (H004) and High Pressure GHe (H005) 

Testing or checking of tanks /line s /fittings always presents 
the hazard of a rupture or burst that could result in personnel injury and 
damage to facilities and equipment. Remote operation or, where required, 
provision for restricted access, and appropriate caution and warning 
procedures can considerably reduce the exposure of personnel to such 
hazards. 


• Electrical Power (H006) 

Probably the single most effective means for preventing elec- 
trical shock to personnel is through the use of GFI devices. The use of 
proper operational procedures, checklists, and safety interlocks will help 
prevent the inadvertent creation of associated electrical hazards, such as 
arcing and high voltage discharge that can result in fires and damage to 
equipment. 
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• RF Emis sions ( H007) 

The wearing of RF monitors by operating personnel can 
effectively limit their exposure to such harmful radiation. All RF 
generating equipment should be turned off before performing hazardous 
operations, such as connecting pyrotechnics devices. 

• Hydrazine and its Methyl Derivatives {H008) 

The obvious requirements of wearing protective clothing, 
masks and gloves and having safety showers and eye wash fountains 
readily accessible will in most cases preclude an accidental spill having 
a marked effect on personnel. Modifications to the SAEF #1 facility to 
include a water flush system and a fresh air purge may be required for 
loading and testing the APS safely. 

• APS Thruster Firing- -Toxic Gas (HO 14) 

Test firing of these thrusters could generate toxic products 
such as ammonia and hydrogen, or through malfunction could create a 
spill of hydrazine. Adequate ventilation and the use of personnel pro- 
tective equipment should preclude any hazard to personnel from this 
operation. 


• Pyrotechnics - -Safed (HO 15) 

The inadvertent activation of ordnance devices can be pre- 
cluded by the following proper procedures, such as using spark proof 
tools, use of shorting caps, and handling and storing explosives only in 
designated facilities. 

• Pyrotechnics - -Armed (HO 17) 

Before removing shorting caps from EED’s and connecting 
pyrotechnic devices, checks should be made for RF or magnetic fields 
and for energized electrical connectors. 

• Batteries (H019) 


Care must be exercised in handling batteries to prevent 
arcing shoots and to prevent electrolytic spills. The use of nonsparking 
tools and wearing of protective clothing and goggles should serve to 
alleviate most of their hazards. 
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# High Pressure GN 2 /GHe (H02Z) 

All operations involving the test, checkout, and operation of 
high pressure systems should be done remotely when possible, i. e. , 
limiting access and number of operating personnel. All GSE servicers 
should be vented and safed before disconnecting. 

• GF^ (H025) 

A fluorine facility that is dedicated to fluorine loading only 
is required because of the highly reactive nature of fluorine. Protective 
clothing and breathing systems are required for personnel working 
around fluorine. Passivation of the F^ tanks and transfer lines is 
required by a special procedure because of the highly reactive nature of 
fluorine. 


• LN^ (H026) 

Piping and tanks should be cold shock tested and leak checked; 
relief valves should be included in dewar systems; LN^ must be vented 

outside when located in the Tug Processing Facility; personnel working 
around LN^.rnust abide by KSC safety requirements for cryogenics. 

• LF^(H028) 

A special transporter designed to control EF^ temperatures 
and saTely contain leaks during transit is required. The loaded F PU 
shall be moved only when weather conditions are favorable and will not 
aggravate the impact of a spill or leak. Also, only essential and trained 
personnel with proper protective clothing and safety devices should be 
allowed where fluorine operations are performed. A F^ disposal unit is 
required at the F^ facility, SAEF #1, and at the pad if emergency 
venting is necessary. 

• Radiological (H029) 

Proper radiation shielding will be required to protect per- 
sonnel and equipment. Occupancy time in “radiation areas“ should be 
limited to that time required to properly perform assigned tasks, and 
all personnel entering radiation controlled areas shall wear a beta- 
gamma -neutron sensitive dosimeter. Before RTG's are installed on a 
spacecraft, work shall not proceed until appropriate health physics 
measurements have been completed and safe levels of exposure are 
verified. Maximum distances between personnel and the radiation 
source (RTG^s) shall be maintained through use of proper handling 
devices. All radiation areas shall be conspicuously posted. 
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• Krypton 85 ( H030) 

Krypton 85 is used as a tracer gas for pressure testing 
systems that have extremely low allowable leak rates. Tests should be 
performed by personnel trained in handling and testing with a radioactive 
gas. All personnel will be required to wear beta-gamma film badges. 

• ^^2 ® (H031) 

The fluorine loading facility shall be used for emergency 
disposal of fluorine when time allows. However, a portable fluorine 
disposal unit should also be provided at SAEF #1 and at the pad in the 
event emergency on site venting is required. Other safety and protective 
actions include maintaining an adequate supply of LN^ for cooling at 
all times, providing a backup cooling system for emergencies, and 
providing sensors at all processing locations and in the Orbiter 
bay. All personnel involved in the operations with the fluorinated 
oxidizer unit should be trained and certified for fluorine operations. 
Emergency or contingency actions should be developed and practiced for 
all possible accident situations. 

• High Temperature ( H032) 

Personnel should wear protective garments, gloves, etc., at 
all times when working with sources of high temperature. All combustible 
materials must be removed from the immediate area before the heater 
is energized. 


• Radiological ( H033) 

Special storage and handling equipment are required 
for RTG's to prevent exposure or direct contact by personnel with 
radiation sources. Special guards and shields and radiological warning 
devices are required during storage and handling. KSC Radiation Pro- 
tection Handbands KHB I860. 1/lS shall be followed. 

• RF (H034) 

Control of this type of electromagnetic radiation is most 
important to avoid personnel injury and initiation of unprotected pyro- 
technic devices. The most obvious and effective measures for con- 
trolling this radiation is to provide covers for the equipment (antennas) 
when not in operation and to provide physical barriers to limit access 
during operations. 
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• Nitrogen Tetroxide--N^O^ (H038) 

Zero leakage service disconnects and protective clothing for 
operating personnel are required to prevent exposure of operations 
personnel to toxic vapors. gas detectors are required for the 

Orbiter bay. Loading operations will be in accordance with the KSC 
loading procedure for N^O and mutually reactive propellants will not be 
loaded at the same time, in the event that spills occur, they shall be 
cleaned up immediately or washed down with water. 

3. 9 PAYLOAD SAFETY RELATED RECOMMENDED CRITERIA 

Identification of the 21 types of hazards associated with 
the lUS cargo normal base line processing flow has also presented the 
requirement for providing pertinent payload design criteria that could 
help to reduce the severity or occurrence of the hazard. The detailed 
criteria set forth for each of these hazards are provided in Appendix E. 
A brief summary of the more significant criteria emanating from this 
study is presented below; 

• GN^ Purge (H002) 

Payload GN^ purge outlets should be located so that the GN 
can be vented outside the Orbiter bay. ^ 

• High Pressure GN^ (H004) and He (H005) 

All high pressure tanks should be designed with pressure 
relief valves to limit pressure and the tanks should be designed to limit 
shrapnel in case of a inadvertent rupture or burst. Pressurized flight 
systems should be connected to the Orbiter vent system to allow venting 
before returning from orbit. 

• Electrical Power (H006) 

All electrical equipment, connectors, etc., should conform to 
the provisions of the National Electrical Code and the applicable NASA 
and MIL Standards. The designs of safety critical switches and controls 
should be such that they are readily accessible in the event of a major 
incident. 


• RF Emissions (H007) 

Equipment that generates EMI radiation should be designed 
to contain this radiation within the equipment and equipment that can 
be advertently affected by RFI should have RF shielding built into its 
de sign. 
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• Hydrazine and its Methyl Derivatives (H008) 

The Orbiter /cargo umbilicals should be designed to limit 
spillage of fluids at the pad or other loading areas to a minimum. Pro- 
pellant systems designs should allow pressurization at the time of 
deployment from the Orbiter bay in space. 

• APS Thruster Firing- - Toxic Gas (HO 14) 

Design of the APS systems should include electrical inter- 
locks to produce inadvertent firing of the system, and provision should 
be made to bring the APS system up to operating pressure only just 
before deployment from the Orbiter in space. Covers or shields over 
APS thrusters should be provided to prevent the release of toxic vapors 
or liquids. 


• Pyrotechnics --Safed (H015) and Armed (H017) 

Ordnance firing circuits must be designed so that after one 
failure, a second failure will not fire the circuit. The payload design 
should include the location of the pyrotechnic initiators for easy access- 
ibility when the cargo is in the Orbiter bay. 

• Batteries (H019) 

Battery and battery connector designs should include the use 
of plug-in type connectors to cut down the possibility of arcing. The 
batteries should also have adequate vents that are connected to the 
Orbiter vent system that would preclude possible battery case over- 
pressurization. 


• GF^ (H025) 

AnF^ sensor at the vent side of the heat exchanger is required 
to detect possible GF or LPt leaks into the heat exchanger. 

Lt 

A heat exchanger in/around the tanks is required to help 
passivate the tank and lines prior to loading h^F ^ and control the 
temperature after loading. 

• Cryogenic FN^ (H0Z6) 

Insulation or shielding should be provided to prevent per- 
sonnel contact with cryogenic temperatures. 
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• LF^ (H028) 

Design of the system should allow maintenance of low 

tank pressure with the cooling system until this unit is deployed 

from the Orbiter. 


The F^PU should contain a minimum of electronics and 
should be hermatically sealed with an F^ compatible material. 

• Radiological (RHU) {H029) 

The RHU*s should include sufficient shielding to prevent 
exposure of operational personnel to radiation, 

• Krypton 85 (H030) 

No new applicable payload design requirements. 

• ^^2 (H031) 

Redundant pressure and temperature sensors should be 
provided. The system design should include a burst diaphram for 
venting after release from Orbiter in space and a remote operated vent 
valve for venting into disposal unit during ground operations. The vent 
system shall be designed so that no single failure allows leakage of 
fluorine. Double container concepts should be considered for LF^ tank 
and line design to preclude leakage. F^ sensors should be included 
between containers. If F^ dumping in space (in case of abort) is pro- 
hibited, then an onboard cooling capability is required. 

The LF system design should allow maintenance of low 
tank pressure by cooling until the unit is deployed from the Orbiter 

in space. Final F^ tank pressurization should be performed in space. 

• High Temperature ( H032) 

The RTG cooling jacket design should allow installation 
without personnel contact with the RTG's. Payload design should 
allow for access to RTG^s for installing the cooling jackets. 

• Radiological (RTG) (H033) 

The RTG location in the payload should allow installation and 
removal after the cargo is in the Orbiter bay. The RTG design should 
include adequate high temperature, fire, blast, and radiation shielding. 
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• RF (H034) 

Power /lockout devices and on/off switches should be included 
to ensure that no single failure can cause inadvertent operation. 

• (H038) 

Final pressurization should be delayed until just before the 
cargo is deployed from the Orbiter in space. 
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4.0 TUG/SEPS/SEOS CARGO PROCESSING PLAN 

4. 1 CARGO DESCRIPTION 

The Tug/SEPS/SEOS cargo consists of the cryogenic reusable 
Tug (MSEC base line configuration) and the SEOS. The SEPS is hard 
docked and locked onto the Tug with explosive release mechanisms. The 
SEOS is similarly attached to the SEPS. (Neither the SEPS nor SEOS is 
structurally attached to the Orbiter bay.) A sketch of the Tug/SEPS/ 
SEOS Cargo is presented in Figure 15. A brief description of each 
element of the cargo follows. 

4. 1. 1 Tug Description 

The Tug is a high energy, reusable, propulsive stage that 
is carried in the Orbiter payload bay and is used to deliver /retrieve / 
service spacecraft. It is capable of delivering 6000 to 800 lb to 
geosynchronous orbit or retrieving 3000 to 4000 lb from geosynchronous 
orbit. Within this capability, it can deliver and retrieve payloads in 
low earth orbit or insert one spacecraft into an earth-escape trajectory. 

The baseline space Tug is composed of structures, propulsion 
avionics, and thermal control systems. Figure 16 presents the current 
general Tug configuration. General descriptions of these Tug systems 
follows: 

4p 1 . 1 . 1 Structure s 

The Tug is structurally attached to the Orbiter cargo bay at 
six points. Four attachment fittings are on the body shell; the other 
two are mounted on the deployment adapter and serve as pivoting 
points. 


Umbilical systems between the Tug and Orbiter will be 
separated prior to Tug deployment and will provide reconnect capability 
for the Tug LO 2 and LH 2 vent and propellant lines, GHe inerting purge, 
and those electrical functions required to maintain the Tug during the 
reentry. All lines and cables between the Tug and Orbiter will be routed 
along the inside of the car^o bay from the aft service points defined by 

the Orbiter base line. The main propellant tank fill and drain lines and 
pressurant lines are attached to interface panels in the payload bay and 
are accessible for servicing through the Orbiter. 
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4. 1.1.2 Propulsion 

The propulsion system provides a vacuum thrust of 15, 000 lb 
from a derivative of the flight -proven Pratt and Whitney RLIO engine. 

The main propellants, LH 2 and L02,are pressurized from a helium 
pressurization system. The helium pressurization system consists of 
two 4.5 ft^ bottles pressurized to 3200 psig. 

The Tug auxiliary propulsion system provides three axis 
attitude control and small AV translation maneuvers for the Tug. It is 
a regulated monopropellant hydrazine system with four pods of six 
thrusters each. Propellant is supplied from three hydrazine tanks 
pressurized by helium. 

4. 1.1,3 Avionics 

The Avionics System consists of the communications; guidance; 
navigation and control; data management; measurement, power, and 
distribution subsystems. The system design provides a high degree of 
in-flight autonomy with ground commands generally required only for 
safety inhibits, mission contingencies, and navigation updates. 

The Tug electrical power is a 28 Vdc system composed of 
power sources, power processing, and distribution and control equipments. 
In addition to providing subsystems power, it will provide up to 600 W 
of power to the spacecraft while it is attached to the Tug. While the Tug 
is in the Orbiter bay, power is supplied to the Tug power bus from the 
Orbiter. 


The Tug power source consists of two Tug designed fuel cells 
each rated at 2, 0 kW with 3, 5 kW peak. Each fuel cell is capable of 
supplying the total load. The fuel cell system has dedicated reactant 
tanks. An auxiliary battery rated at 25 A-hr supplements in rush 
current requirements for motor loads and powers up the fuel cells. 

4. 1. 1.4 Thermal Conditioning 

Thermal conditioning of the Tug is accomplished by both 
active and passive means. The fuel cells waste heat is rejected to 
space by an active thermal control system using Freon 21 circulated by 
dual redundant pumps through radiators, .selector valves, a temperature 
control valve, and the fuel cell heat exchanger. The forward skirt panel 
mounted avionics will be cooled by lightweight radiation shields and 
heated by electrical heaters controlled by the central computer. Heat 
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pipes provide thermal control when the Tug is perpendicular to the sun. 
The temperature of the avionics in the intertank area will be controlled 
by heat pipes alone, 

4, 1. 1. 5 Summary of Hazardous Materials/Systems 

These Tug systems will require checkout and servicing 
during ground processing. The following hazardous materials are 
carried by the Tug and are of concern in processing the Tug; 

• LO2 

• 

m Hydrazine 

• High Pressure Helium 

• High Pressure Nitrogen 

• Pyrotechnics 

• Electrical 

• Pyrotechnics 

• Batteries 

• Hydraulics 

4.1.2 SEPS Description 


The SEPS is a versatile and efficient unmanned space vehicle 
that can complement the Shuttle and the Orbit -to -Orbit Shuttle /Tug for 
both earth -orbital and planetary missions. It can retrieve, as well as 
deliver, large payloads from geosynchronous orbit, or perform space 
servicing of several geosynchronous satellites during a single mission. 
The SEPS can also transport payloads to planets, comets, and asteriods 
that are difficult or unreasonable with chemical vehicles alone. The 
earth orbital version was selected for this study. 
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This multipurpose space vehicle that only weighs about 
6, 000 lb, can generate a total impulse equivalent to a 24, 000 -lb 
chemical stage. This is achieved with the 3000 sec specific impulse 
of a low thrust ion propulsion system. 

Figure 1 ( presents the basic earth orbital SEPS configuration. 
The primary subsystems on SEPS are described below, 

4, 1, 2. 1 Propulsion 

The basic power source of SEPS is the dual solar array 
(131- by 1230-in. each), which provides 21 kW of power. It is assumed 
that the solar arrays will not be extended during ground processing at 
KSC. This is primarily due to the space and complex fixturing require-- 
ments for 1 g operation. 

The thrust is provided by an ion thruster array assembly 
consisting of nine gimballed thrusters (seven normal and two spare). 

The thruster array has a translation mechanism that will position any 
thruster 2 in. past the SEPS center line. 

The propellant, mercury (3200 lb), is fed by Freon 113 
pressurant. At worst case it is assumed that this propellant and 
pressurant must be loaded during ground processing at KSC, 

4, 1.2,2 Reaction Control 

This system, required for orientation during coast and 
docking, consists of 18 thrusters and 2 hydrazine storage tanks with 
appropriate valving. The propellant is pressurized by GN^. 


4. 1. 2, 3 Energy Storage and Distribution 

The system provides the flight batteries, converters, 
inverters, battery chargers, regulators, etc. , required for the payload 
and onboard systems. 

4. 1,2,4 Miscellaneous Systems 

Other systems onboard requiring checkout (no significant 
servicing functions) during ground processing include the data handling, 
command computer, guidance and control, docking, and communications 
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systems. However, the docking system includes a laser device that 
induces a unique hazard during checkout, 

4, 1. 2, 5 Summary of Hazardous Materials/ Systems 

The hazardous materials/systems for ground processing are: 

• Mercury 3000 lbs) 

• High Pressure Freon 113 

• Hydrazine 

• High Pressure GN 2 

• Pyrotechnic 

• Laser Radar 

• High Temperature (Heater) 

• Electrical 

• Batte rie s . 

4,1.3 SEOS Description 

The mission of SEOS is to investigate sensing techniques 
for measuring environmental phenomena from a geosynchronous orbit. 
Typical phenomena to be studied are tornadoes, hurricanes, hail storms, 
air pollution, floods, water pollution/biological productivity,' navigational 
hazards, soil moisture, water availability, forest fires, shoreline 
erosion, and crop infestation. 

The major piece of equipment onboard is a Cassegrainian 
telescope, including a light baffle and focusing mechanism. The sensor 
assembly includes the following: 


78 



WTELEOrNE 

BROWN ENGINEERING 


Quantity 

1 

12 

9 

6 

1 


Description 

Linear Silicon Diode Array 

Photomultipliers 

Silicon Detectors 

Mercury Cadmium Telluride Detectors 
Immersed Thermistor Bolometer 


Also, there is a data collection system and antenna for 
data management. Figure 18 presents a preliminary sketch of the SEOS 
concept. 


Supporting subsystems include: 

• Structure- - cruciform structure. 

• Environmental Control- - passive cooling with heat pipes. 

• Guidance and Navigation -- sun and earth sensors, 

star trackers, and momentum wheels. 

o Propulsion - -hydrazine thruster system for orbit 

trim, station keeping, and momentum wheel unloading. 

o Telemetry, Tracking, Command --transponder for range 

and rage rate, s-band telemetry. 

• Electrical -- two rotating solar arrays. Direct energy 

transfer-type power conditioning. 

4. 1. 3. 1 Summary of Hazardous Materials 

The only hazardous materials of concern in processing SEOS 
are hydrazine, high pressure GN 2 , electrical, RF, and pyrotechnics. 
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4, 2 PROCESSING SCENARIO 

The Tug/SEPS/SEOS processing scenario shows a likely 
sequence of operations essential to process this cargo for the prelaunch, 
launch, and post-flight phases of its operational cycle. Buildings and 
areas have been identified that most reasonably accommodate the major 
operations required to process the individual elements (Tug, SEPS, and 
SEOS) of this cargo as well as those for the combined cargo. 

Throughout the analysis there has been a continuous endeavor 
to evolve the best practical sequence of activities for a reasonably safe 
and timely set of prelaunch and post-launch processing plans. This has 
been reflected in our selection of the relative placement of activities 
with respect to one another and the location where performed. 


The scenario (Figure 19) covers the full cycle of operations 

as follows: 


Tug is off-loaded at KSC airstrip and transported to 

SAEF #1 where it is inspected, shipped loose parts assembled, 

and the auxiliary propulsion system loaded and safed. 

The SEPS and SEOS are moved from the air strip to 
the AE Hanger where each is inspected, shipped loose 
parts assembled, and functionally tested. They are 
then transported to the Propellant L.ab 60A where in 
the case of SEPS, both the auxiliary propulsion system 
and the low thrust propulsion system are loaded with 
hydrazine and mercury, respectively. The SEOS 
propulsion system is, also, loaded at 60A. 

SEPS and SEOS are transferred to SAEF #1 where they 
are mated with the Tug to form the designated cargo. 

While at SAEF #1, the cargo undergoes integrated 
systems tests and the installation of Class A 
ordnance. Since the cargo is to be loaded at the 
pad through the PCR, it is installed in a canister and 
transported to the launch pad. 
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• At the pad, the PCR is extended and the cargo loaded 
canister is lifted from a transporter into the PCR. 

The batteries are installed, the main power bus is 
verified, and the cargo is installed in the Orbiter 
bay. The Orbiter/cargo interfaces are made and 
verified, the Orbiter bay is closed, and the PCR 

is retracted. 

• During the countdown, the Shuttle propellants are 
loaded and the Tug Main Propulsion System is loaded 
with cryogenics. 

• In-flight operations are performed and cargoes are 
exchanged. It was assumed, for this analysis, that 
the returning cargo would also be a Tug/SEPS/ 

SEOS to establish a full operational cycle 

for such a cargo. Prior to the actual retrieval of 
the cargo, some safing operations are performed, 
and after the cargo has been retrieved into the 
Orbiter bay more safing activities take place. These 
constitute in-flight safing as shown on the scenario. 

• Assuming a normal Orbiter landing, Orbiter safing 
takes place prior to towing the Orbiter to the OPF, 

At the OPF, the cargo is removed from the Orbiter 
and transported to SAEF #l where SEOS and SEPS 
are demated from the Tug. All three elements 
(Tug, SEPS, and SEOS) are deactivated. 

• SEPS and SEOS are prepared for transporting and are 

returned to their respective vendors for refurbishment. 
The Tug is refurbished at SAEF #1 and either sent 

to storage, or put back into operation. 

In addition to the normal processing base line previously 
discussed, five contingency situations are presented. Two contingency 
situations at the pad are shown: 

• Backout Operations 

• Vertical Changeout 

The third contingency. Mission Abort, is shown as an 
alternative to the normal in-flight operations. The fourth and fifth 
contingencies are: 
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• Landing at Alternate Site 

• Crash Landing 

These are presented as alternatives to the normal landing 
operations at KSC and contingency flow plans for these situations are 
included in Volume 4. 

4.3 PROCESSING FLOWS 

This section presents the Tug/SEPS/SEOS Launch Site 
Processing Flow Plans that were derived during this study. These flow 
plans identify each major operation necessary to prepare the payload for 
flight and post-flight refurbishment and acknowledge the payload hazardous 
parameters that exist during these operations. 


A top-level flow was developed to show individual payload 
operations, cargo operations, launch operations, and post-launch 
operations. This top-level flow is essentially an index of operations 
at different areas and was expanded into a detailed operational sequence 
for each cargo. This detailed operational sequence was an iterative 
process and through a series of iterative tradeoffs the normal base line 
processing flow plans were formed. 

4. 3. 1 Top-Level 

While the scenario for the Tug/SEPS/SEOS cargo shows 
basic and essential operations to enable its processing, a slightly different 
format was established to be used as a top level functional flow. The top- 
level Tug/SEPS /SEOS Launch Site Proces sing Flow Plan is presented 
in Figure 20, This figure shows nine major areas that provide 
convenient breakouts for the second level functional flows and have been 
addressed at the first level. A brief description of each block in this 
processing sequence is provided. Contingency and reference blocks 
are included on this chart to show the chronological relationship of the 
activities (these blocks will not be discussed in this section). 

• 1.0 Tug Premate Processing 

• 2. 0 SEPS Premate Processing 

• 3, 0 SEOS Premate Processing 
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• 4. 0 Cargo Mating and Prelaunch Processing 

• 5. 0 Pad Operations 

• 6. 0 Landing, Safing, and Demating Operations 

• 7.0 Tug Refurbishment Operations 

• 8.0 SEPS Refurbishment Operations 

• 9. 0 SEOS Refurbishment Operations 

4. 3. Z Normal Base Line 


The Tug/SEPS/SEOS second level functional flow diagram 
referred to as the normal base line processing flow is an expansion of 
the first level with sufficient details to enable a hazards analysis to be 
performed from the second level functional event sheets. 

The Normal Base Line Processing Flow (Figure Zl) 
represents the output of an iterative process. Many feasible options in 
sequencing certain activities were examined and cursory analyses were 
made to weigh their respective advantages and disadvantages considering 
the parameters of safety, time, and facilities. Through this process 
some hazardous operations were either eliminated, reduced, or replaced 
by less hazardous ones, or the sequence and/or locations changed so as 
to have a lesser impact. This process led to the evolvement of the 
normal base line processing flow. For each individual item on these 
flows, a functional event sheet was prepared to define the operation to 
a level necessary to identify all hazards, estimate operations times, 
and identify GSE. 

Certain basic assumptions were made during the formulation 
of the normal base line processing flows. These are discussed below. 

• Mission --It is assumed, for study continuity, that an 
expended Tug/SEPS/SEOS is returned. 

• Insulation Purge - -Because of the preliminary nature of 
the data available, the high performance insulation (HPI) 
purge requirements are uncertain. To cover all cases, 
continuous purge is used during preflight processing for 
the SEPS and SEOS and no purge is used during ground 
processing of Tug. It is assumed that the Tug HPI is 
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dried with hot GN2. purged with He, and sealed during 
refurbishment. This seal is assumed to be good 
throughout preflight processing. It is further assumed 
that the HPI on SEPS and SEOS will be replaced during 
refurbishment. 

• Refurbishment --It is assumed that the major Tug 
refurbishment activity is performed at KSC and that, 
because of the highly specialized equipment require- 
ments, the SEPS and SEOS are returned to the vendor 
for refurbishment. 

• Other --To explore the processing of the mercury hazard 
on SEPS, it is assumed that the mercury and its pres- 
surant, Freon 113 , are loaded during processing (and 
not preloaded at the vendor). 

4 3_ 3 Options to Normal Base Line and Trade Studies 

In the development of the Normal Base Line Processing Flows, 
alternate flow plans were studied and analyzed to develop the optimum 
operational sequence of flow for processing the Tug /SEPS/SEOS cargo. 
These options present areas of the normal base line processing flow 
concept that required additional study and trade offs to ensure the 
selection and development of the most feasible and time /cost effective 
approach as far as the safety aspects are concerned. 

Four major options to the Tug/SEPS/SEOS selected normal 
base line concept were investigated: 

• Load cargo into Orbiter at the OPF 

Not fueled 
SEPS fueled. 

• Load Tug only into Orbiter at OPF then mate SEPS 
and SEOS with Orbiter at the pad. 

• Load unfueled cargo into Orbiter at the pad. 

• Load cargo into the Orbiter at the pad with the SEPS 
fueled and the APS systems fueled but not pressurized. 
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Each of the options has advantages and disadvantages. 

Many parameters were considered in making our base line selection, 
such as types of propellants, processing time, checkout considerations, 
and effect of hazard. The fourth option was selected as the most 
advantageous for the normal base line from a practical safety standpoint. 

The primary driver for selecting the fourth option was the 
problems associated with mercury, which is the SEPS^s primary pro- 
pulsion systems fuel. Because of the dispersive nature of mercury, a 
mercury leak could result in a mission scrub because of payloads and 
Orbiter contamination, which would require major refurbishment. The 
high surface tension and low viscosity properties of mercury cause it 
to break into small droplets upon impact. These droplets, some smaller 
than the eye can see, can cause electrical shorts and corrosion. Mer- 
cury cannot be readily absorbed or disolved and there are no practical 
solvents that can be used. In case of mercury leakage, disassembly 
will usually be required for cleanup. 

Considering the constraints imposed by a mercury fueled 
SEPS, the cargo should be installed as late in the processing as possible. 
This would eliminate the option of loading the cargo into Orbiter at 
the OPF with the SEPS fueled. Considering the mercury loading 
process as resulting in the highest likelihood of spills, loading the 
SEPS with mercury after installation in the Orbiter bay would be very 
hazardous. This consideration would eliminate the options of loading 
the unfueled cargo into Orbiter at the pad and at the OPF. The difficulty 
from an access standpoint of integrating a payload in the cargo bay and 
the extended on line time required to integrate the SEPS and SEOS to the 
Tug along with the testing time required, eliminated the option of loading 
the Tug only into Orbiter at OPF and then mating SEPS and SEOS with 
Orbiter at the pad. The option of loading cargo into the Orbiter at 
the pad with the SEPS fueled and the APS systems fueled but not 
pressurized was most desirable because the SEPS loading was 
performed before mating and integration thereby minimizing other 
hardware exposure to mercury contamination, by a spill during loading. 
Integration of the payloads prior to mating with the Orbiter allows 
adequate time for cargo testing without affecting the Orbiter on line 
time. 

4. 4 FUNCTIONAL EVENTS DESCRIPTION 

The purpose of these functional event sheets is to describe 
each Tug/SEPS/SEOS processing operation, give the sequence of events 
required to complete the operation, and estimate the time required. For 
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each event in the operation, potential hazardous conditions are noted and 
cross-referenced to a hazards analysis, GSE and facilities associated 
with this operation are also shown. Hazardous materials or systems 
loaded or activated in a previous operation are indicated by hazard 
category. 


The operation sequence portion of these functional event 
sheets define each of the Tug/SEPS/SEOS normal base line processing 
flow operations to a level necessary to identify all hazards, estimate 
operations times, and identify GSE. Eighty-eight normal base line 
processing flow operations were identified for the Tug/SEPS/SEOS 
cargo. Potentially hazardous conditions were identified as being 
associated with 64 of these 88 operations. 

The functional event sheets for the Tug/SEPS/SEOS normal 
base line processing flow operations are in Appendix C. 

4. 5 WATERFALL/ TIME LINE 

The Tug /SEPS/SEOS Wate rfall/ Time line provides a visual 
guide to the series and parallel relationship of the various processing flow 
operations and is time-phased to show the time allocation for each 
operation. The processing flow operations were base lined early in this 
study in accordance with KSC Shuttle /Tug Turnaround Allocation, August 
Z8, 1974. These time lines were not updated by subsequent changes or 
modifications to the operational allocations since these changes were not 
detrimental to the results of this study. The numbers and titles appearing 
on the events refer to the Tug/SEPS/SEOS functional flow diagram item 
numbers. 

4. 5, 1 Normal Base Line 


The normal base line processing flow time line is illustrated 
in Figure 2Z. This time line shows the complete flow of each element of 
this cargo from arrival at KSC to launch, for preflight operations, and 
from Orbiter landing to completion of refurbishment for post -flight opera- 
tions. The Tug, SEPS, and SEOS are individually followed (through 
SAEF #1, AE Building, and Propellant Lab 60 A) until they are mated into 
an integrated cargo at approximately 60 hr prior to launch. The pad 
time for this cargo is 30 hr. The Shuttle events for this time line are 
referenced but are not identified. 
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The initiation of cargo post-flight operations are constrained 
by the 1 1 hr of Orbiter safing operations. 

4. 6 GSE AND FACILITY REQUIREMENTS 

This section presents the major GSE and facility requirements 
for processing operations that have been identified as a result of the 
processing flows. These items are recognized as essential for the 
successful processing of the cargo. 

Any experiment unique GSE will be furnished by the user, 
with the possible exception of transportation items or other items KSC 
may agree to furnish upon request. It was originally planned that specific 
experiment equipment would also be identified. However, there is 
insufficient information available to be definitive of particular experiments. 
Some facility requirements were envisaged to support different experi- 
ment groups, however^ 

For the Tug /SEPS/SEOS cargo, a support equipment listing 
of required equipment to meet specific processing requirements and 
functions was prepared. From this listing, support equipment identification 
sheets were prepared for servicing equipment and facility items that were 
new, peculiar, or associated with hazardous operations. 

The Support Equipment Listings were separated into facility 
equipment, identified with a ^'F^* number, and a powered cargo, identified 
with a number. The »‘P'' identification was further divided into 

servicing, handling and access, electrical, transportation, and mis- 
cellaneous by the addition of a appropriate second letter. 

For the Tug/SEPS/SEOS cargo, 21 items of facility equipment 
and approximately 140 items of support equipment have been recognized 
as a result of the processing flows. From this listing, support equipment 
identification sheets were prepared for some items.The title, basic function, 
and description of these items are shown on these sheets. The support 
equipment listing for the following Tug/SEPS/SEOS equipment categories 
is included in Appendix D; 

• Facility 

• Electrical 
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• Handling and Access 

• Servicing 

• Transportation 

• Miscellaneous, 

4. 7 PROCESSING HAZARDS SUMMARY 

Twenty hazard types have been identified with 64 operational 
events in the Tug Cargo Normal Base Line Processing Flow. These 
hazard types, their HMEA number, the frequency with which they 
occur, and the final hazard categorization after the application of 
hazard reduction methods are as follows: 


HMEA Frequency of Final Hazard 


Hazard Types 

Number 

Occurrence 

Categorization 

GN^ Purge =1= 

H 002 

15 

Controlled 

High Pressure GN^'’' 

H004 

8 

Catastrophic 

High Pressure He'*= 

H005 

8 

Catastrophic 

Electrical Power 

H006 

26 

Controlled 

RF Emissions 

H007 

4 

Controlled 

Hydrazine and Methyl 
Derivatives 

H008 

6 

Critical 

Laser 

H009 

1 

Controlled 

High Temperature - - 
Elec. Heaters 

HOlO 

1 

Controlled 

Moving Equipment 

HO 11 

1 

Controlled 

F reon'-^ 

H012 

1 

Catastrophic 

Mercury'll 

HO 13 

2 

2 

Controlled 

Critical 

APS Thruster Firing-- 
Toxic Gas 

HO 14 

2 

Critical 

Ordnance - - Safed 

H015 

5 

Controlled 

Pyrotechnics --Armed'l' 

H017 

2 

Controlled 

Batteries 

HOI 9 

4 

Controlled 

Cryogenic LO^'*' 
Cyrogenic LH^'^ 

H020 

3 

Critical 

H021 

4 

Critical 

High Pressure “-GN 2 / 


1 

Catastrophic 

GHe^:^ 

H022 

2 

Controlled 


''' Also, continue or carry over to other operations and present the 
possibility of interface or interaction effects during subsequent 
operations. 
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Hazard Types 


HMEA Frequency of Final Hazard 
Number Occurrence Categorization 


Hydraulics H023 

Purge With Hot GN^ H039 


1 Controlled 

1 Controlled 


"^■7.1 Hazard Mode and Effects Analysis 

Functional Event Sheets for the Tug/SEPS/SEOS Normal 
Processing Base Line flagged each hazardous operation for a hazard 
analysis. By examining each operational event (where a hazard or 
hazards had been uncovered) in conjunction with the HMEA of that type 
of hazard (e. g. , laser and electrical), a determination of the initial 
hazard impact on the payload, cargo, facilities, Orbiter, and personnel 
was made. The impact whether catastrophic, critical, or controlled 
and what was affected, such as payload and cargo, was indicated on the 
Normal Processing Base Line Flow along with the final categorization 
that shows the result after the application of control measures listed on 
the HMEA for that hazard type. The HMEA’ s for the 20 hazard types 
shown in Paragraph 4. 7 are located in Appendix E. 


4. 7. 2 Interface Hazards 


If the hazard were a "one event only" hazard, it was indicated 
on the flow chart by a hexagon. If the hazard were one that would con- 
tinue over several operational events, it was indicated by a circle and 
a line was run from the source event to the terminal event where the 
hazard was closed out with a hexagon. Events containing more 
than one hazard may have interface hazards associated with them, 
and also, events where hazards are contained from previous events 
operating on or operated on by an event initiated hazard can also have 
interface hazards. In this manner, the processing flow clearly shows 
all possible hazard interactions for each operation. 

An interface hazard represents a potential accident type that 
could occur if one hazard source were to go out -of -control (an accident) 
and operate on another potential hazard source causing it to also go 
out -of -control. In accidents resulting from an interface, the combined 
effects are often a different and/or worse (synergistic) effect than the 
singular uncombined effects of either. 

In the Tug/SEPS/SEOS Normal Base Line Processing Flow, 10 
events present potential interface hazards. These hazards and their ' 
potential effects are described below; 
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• Tug Event 1. 07 - Perform Instrumentation and Com- 
munications Systems Tests 

• Tug Event 7. 09 - Check Out Instrumentation and Com- 
munications Systems Tests 

• SEPS Event Z. 10 - Test Communication System 

• SEOS Event 3. 08 - Test Telemetry Tracking and 
Command Systems. 

In each of these events, electrical power is applied to make 
checks and verifications of various communications and instrumenta- 
tion networks. Either through human error or equipment malfunction, 
power could be inadvertently applied to the RF links, thereby producing 
RF emissions. The RF emissions can cause human injury and result 
in the malfunction of sensitive equipment within the range of the 
radiation field. 

Similarily, electrical power application to make various 
other checks and verifications during normal processing operations 
could lead to additional interface hazards such as: 

m SEPS Event 2. 09 - Test G&N System, 

Inadvertent power application to the laser radar during veri- 
fication of the proper operation of the major GfcN elements could 
lead to exposure of personnel and equipment to the laser beam, thereby 
resulting in possible personnel injury, fire, and/or equipment damage. 

• SEPS Event 2. 11 - Test Thermal Control System. 

Electrical power application to the heaters to verify their 
operation in the Thermal Control System could result in an interface 
hazard. Should the heaters inadvertently not be shut down, or power 
accidentally applied to them after the test was complete, either through 
human error or heater malfunction, it is possible that an uncontrolled 
combustion could occur. This could result in the release of hot or toxic 
gases and possible personnel injury or fire and contamination. 

• , SEPS Event 2. 12 - Test Mechanism and Valve Actuation 

The application of electrical power is made to verify the 
command and control of the thruster gimbals in this event. Through 
a malfunction or human error, the inadvertent application of electrical 
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power to the system at some other time could result in personnel injury 
and equipment damage. 

• SEPS Event 2. 16 - Test Fire APS 

• SEOS Event 3. 11 - Test Fire MPS 

The thrusters are fired to check the operation of the propul- 
sion systems. A thruster malfunction could result in the spillage of 
hydrazine, which in turn could be ignited by electrical power malfunction. 
This could result in a possible fire or explosion, leading to possible 
personnel injury and damage to equipment and facility. 

• Cargo Event 5. 09 - Connect Or biter /Car go Interfaces and 

Verify 

In this event, electrical power is applied to verify the various 
Orbiter /car go interfaces. Inadvertent power application to the pyro- 
technic devices could result in an explosion or fire, which in turn could 
ignite the hydrazine released by the explosion, resulting in personnel 
injury and/or damage to the cargo and Orbiter. 

4. 8 SAFETY REQUIREMENTS AND LAUNCH SITE PROTECTION 

Identification of the 20 types of hazards associated with the 
Tug Cargo Normal Base Line Processing Flow has presented the require- 
ment for providing recommendations and/or preventative measures 
that could help to alleviate the severity /occur rence of the hazard. 

The detailed safety, operational, and facility requirements for each of 
these 20 hazards are presented in Appendix E. A summary of the more 
pertinent requirements that have been established for each of the 
identified hazards is presented below: 

. • ^^2 (H002) and Hot GN 2 Purge (H039) 

The prevention of personnel injury from asphyxiation can be 
effected most readily by limiting the access of personnel to areas 
where purge operations are being conducted, and to provide proper 
ventilation or self-contained breathing apparatus for those persons that 
must enter the area. Proper use of restraints or tiedowns and 
vent/relief capability can help preclude rupture of high pressure vessels 
and lines, and thereby prevent damage to personnel and equipment 
caused by whipping of unsecured lines, etc. 
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• High Pressure GN^ (H004) and High Pressure He (H005) 

High pressure testing or checking of tanks /lines /fittings 
always presents the hazard of a rupture or burst that 'could result in 
personnel injury and damage to facilities and equipment. Remote 
operation or, where required, provision for restricted access and 
appropriate caution and warning procedures can considerably reduce 
the exposure of personnel to such hazards. 

• Electrical Power (H006) 

Probably the single most effective means for preventing 
electrical shock to personnel is through the use of GFI devices. The 
use of proper operational procedures, checklists, and safety interlocks 
will help prevent the inadvertent creation of associated electrical 
hazards, such as arcing and high voltage discharge, which can result 
in fires and damage to equipment. 

• RF Emissions (H007) 

The wearing of RF monitors by operating personnel can 
effectively limit their exposure to such harmful radiation. All RF 
generating equipment should be turned off before performing hazardous 
operations, such as connecting pyrotechnics devices, 

• Hydrazine and its Methyl Derivatives (H008) 

The obvious requirements of wearing protective clothing, 
masks, and gloves and having safety showers and eye wash fountains 
readily accessible will in most cases preclude an accidental spill having 
a marked effect on personnel. Modifications to the SAEF #1 facility 
to include a water flush system and a fresh air purge may be required 
for loading and testing the APS safely. 

• Laser (H009) 

A laser checkout facility should be used to limit access to the 
area during testing, and to provide barriers and curtains to contain the 
reflected light. Eye shields should be worn at all times during tests 
with lasers. 
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• High Temperature Electric Heaters (HO 10) 

Personnel should wear protective garments, gloves, etc., 
at all times when working with sources of high temperature. All com- 
bustible materials must be removed from the immediate area before 
the heaters are energized. 

• Moving/Rotating Equipment (HOll) 

Provision must be made to limit access and clear the area 
before operating movable or extendable equipment and to ensure that 
there is no interference with the moving equipment during planned 
operations. 


• Freon (HOlZ) 

Adequate facility ventilation and avoidance of smoking or open 
flames in the area where halocarbon vapors may be present should pre- 
clude most hazardous conditions to personnel from these materials. 

• Mercury ( H013) 

Adequate ventilation and provision to rapidly clean up any 
spilled mercury should prevent most harmful effects of mercury vapor 
on operating personnel. 

• APS Thruster Firing Toxic Gas (H014) 

Test firing of these thrusters could generate toxic products 
such as ammonia and hydrogen, or through malfunction could create a 
spill of hydrazine. Adequate ventilation and the use of personal pro- 
tective equipment should preclude any hazard to personnel from this 
operation. 


• Pyrotechnics Safed(H015) 

The inadvertent activation of ordnance devices can be pre- 
cluded by the following proper procedures, such as using spark proof 
tools, use of shorting caps, and handling and storing explosions only in 
designated facilities. 
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• Pyrotechnics Armed (H017) 

Before removing shorting caps from EED's and connecting 
pryotechnic devices, checks should be made for RF or magnetic fields 
and for energized electrical connectors. 

• Batteries (H019) 

Care must be exercised in handling batteries to prevent 
arcing/shorts and to prevent electrolytic spills. The use of nonsparking 
tools and wearing of protective clothing and goggles should serve to 
alleviate most of these hazards, 

• Cryogenic LO^ (H020) 

Operations involving significantly increase the fire 

hazard associated with combustible materials in the area. Working with 
cryogenics necessitates the wearing of personal protective gear, such 
as masks, and gloves to prevent personnel injury. 

• Cryogenic H021 

Adequate ventilation during operations involving BH 2 can help 
prevent possible asphyxiation of personnel and the possibility of a fire 
or explosion. The cryogenic lines should be drained, purged,and warmed 
to ambient temperature before breaking connections to prevent spills, 
etc. 


• High Pressure --GN 2 /GHe (H022) 

All operations involving the test, checkout, and operation of 
high pressure systems should be done remotely in as much as possible, 
i. e. limiting access and number of operating personnel. All GSE 
services should be vented and safed before disconnecting. 

• Hydraulics (H023) 

These systems should be treated for hazardous conditions 
just as other high pressure systems, with the added hazard that spills or 
leaks could lead to a possible fire hazard. 
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4. 9 PAYLOAD SAFETY RELATED RECOMMENDED CRITERIA 

Identification of the 20 types of hazards associated with 
the Tug Cargo Normal Base Line Processing Flow has also presented 
the requirement for providing pertinent payload design criteria that 
could help reduce the severity or occurrence of the hazard. The 
detailed criteria set forth for each of these hazards are provided in 
Appendix E. A brief summary of the more significant criteria emanating 
from this study is presented below: 


• ^^2 (H002) and Hot GN^ Purge (H039) 

No payload design requirements were found to be applicable 
to this hazard. 

• High Pressure GN^ (H004) and He (H005) 

All high pressure tanks should be designed with pressure 
relief valves to limit pressure and the tanks should be designed to limit 
shrapnel in case of a inadvertent rupture or burst. Pressurized 
flight systems should be connected to the Orbiter vent system to allow 
venting before returning from orbit. 

• Electrical Power (H006) 

All electrical equipment, connectors, etc., should conform to 
the provisions of the National Electrical Code and the applicable NASA 
and MIL Standards, The designs of safety critical switches and con- 
trols should be such that they are readily accessible in the event of 
a major incident. 

• RF Emissions ( HOOT) 

Equipment that generates EMI radiation should be designed 
to contain this radiation within the equipment and equipment that 
can be adversely affected by RFI should have RF shielding built into 
its design. 


• Hydrazine and its Methyl Derivatives (H008) 

The Orbiter /GSE umbilicals should be designed to limit 
spillage of fuels at the pad or other loading areas to a minimum. 
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• Laser ( H009) 

Safety related design features for laser operations should 
include electrical/mechanical interlocks to prevent inadvertent 
energization, limiters, or stops to limit pointing direction, and a control 
and warning system to provide a warning if the beam is out -of -limits, 

• High Temperature Electric Heaters (HO 10) 

Ele ctrical /me chanical interlocks should be incorporated 
into the system to prevent inadvertent energization. 

• Moving Equipment (HO 11) 

All moving /rotating equipment should be provided with limit 
stops or shields to preclude contact with the equipment during operation. 

• Freon (H012) 

All systems using pressurized gases should include pro- 
visions for the relief of overpressure and for the venting of the systems 
in orbit. 


• Mercury (H013) 

Consideration should be given to designing mercury tanks and 
lines that are double sealed or contained to prevent leaks into the 
atmosphere or the Cargo Bay. The payload mercury tanks should not 
be brought up to operating pressure until the payload is deployed from 
the Orbiter in space. 

• APS Thruster Firing --Toxic Gas ( HO 14) 

Design of the APS systems should include electrical inter- 
locks to preclude inadvertent firing of the system, and provision should 
be made to bring the APS system up to operating pressure only just 
before deployment from the Orbiter in space. 

• Pyrotechnics Safed (HOI 5)and Armed (H017) 

Ordnance firing- circuits must be designed so that after one 
failure, a second failure will not fire the circuit. The payload design 
should include the location of the pyrotechnic initiators for easy 
accessibility when the cargo is in the Orbiter Bay, 
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• Batteries (H019) 

Battery and battery connector designs should include the use 
of plug-in type connectors to cut down the possibility of arcing. The 
batteries should also have adequate vents that are connected to the 
Orbiter vent system that would preclude possible battery case over- 
pressure. 


• Cryogenic LO^ (H020) 

Because of the shock sensitivity of a number of rhaterials 
in all seals and lubricants used must be compatible with LO^. To 

avoid overpressurization, the fuel cell and BOX tanks should have 
redundant vent and relief valves that are connected to the Orbiter vent 
system. 


• Cryogenic (H021) 

As for the LO^ systems design, the fuel cell and L,H^ tanks 
should have redundant vent and relief valves that are connected to the 
Orbiter vent system. Where feasible, all such toxic/hazardous pro- 
pellant systems should not be pressurized until just before deployment 
from the Orbiter in orbit, 

• High Pressure GN^/GHe (H022) 

Design criteria applicable to GN^ and GHe have been dis- 
cussed previously under (H004) and (H005). 

• Hydraulics (H023) 

All payloads flown in the Shuttle should use non or low- 
flammable hydraulic fluids to reduce the hazards associated with these 
fluids. 
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